Home → Guides → What is Base64

What Is Base64? Uses, Size Overhead and Why It Isn't Encryption

By Utivaro Team · Published September 30, 2026

Base64 turns any data into 64 safe text characters so it can travel through email, JSON and URLs. Every 3 bytes become 4 characters, so the result is about 33% larger. It has no key: anyone can decode it, so it is never a way to protect data.

What Base64 is

Base64 is a way to write any data, including text, images or files, using only 64 safe characters: A–Z, a–z, 0–9, + and /, with = for padding. It exists because many systems were built to carry text, not raw bytes. Email, JSON, URLs, HTML attributes and configuration files can all break on binary data or unusual characters. Base64 turns that data into plain characters that travel safely, and the receiver decodes it back to the exact original bytes.

How it works

Base64 takes the input 3 bytes (24 bits) at a time and splits them into four 6-bit groups. Each 6-bit group is a number from 0 to 63, which maps to one character. So every 3 bytes of input become 4 characters of output.

Encoding the word Hi!:

  1. Bytes: H = 72, i = 105, ! = 33.
  2. In binary: 01001000 01101001 00100001.
  3. Regrouped into 6 bits: 010010 000110 100100 100001 = 18, 6, 36, 33.
  4. Looked up in the alphabet: 18 = S, 6 = G, 36 = k, 33 = h.

Result: SGkh.

When the input isn't a multiple of 3 bytes, the output is padded with =. "Hi" (2 bytes) becomes SGk=; "Hello" (5 bytes) becomes SGVsbG8=.

Examples

TextUTF-8 bytesBase64Characters
Hi2SGk=4
Hi!3SGkh4
Hello5SGVsbG8=8
Hello, world!13SGVsbG8sIHdvcmxkIQ==20
café5Y2Fmw6k=8
مرحبا102YXYsdit2KjYpw==16

Notice that "café" is 4 letters but 5 bytes, because é takes 2 bytes in UTF-8, and the Arabic word takes 10 bytes for 5 letters. Base64 encodes bytes, so the text is first converted to UTF-8. The Base64 Encoder / Decoder does this automatically, which is why it handles non-English text correctly; some older tools produce garbled output for anything beyond basic English.

The size cost: about 33%

Because 3 bytes become 4 characters, Base64 output is always about 4/3 the size of the input:

OriginalBase64 lengthIncrease
1 KB (1,024 bytes)1,368 characters+33.6%
100 KB136,536 characters+33.3%
1 MB1,398,104 characters+33.3%

Email attachments add a little more: MIME wraps Base64 into lines of 76 characters, and the line breaks bring the total to about 37% larger than the file. That's why a 10 MB attachment can hit a 13–14 MB email limit.

The formula: output length = 4 × ⌈input bytes ÷ 3⌉, where ⌈ ⌉ means round up.

Where you'll meet Base64

  • Email attachments, encoded automatically by your mail program.
  • Data URLs in HTML and CSS, such as data:image/png;base64,iVBOR..., which embed a small image directly in the page.
  • APIs that send files or images inside JSON.
  • HTTP Basic authentication, which sends username:password in Base64.
  • JSON Web Tokens (JWTs), which use a URL-safe variant called Base64URL.
  • Configuration files and keys, such as certificates in PEM format.

Base64 is not encryption

This is the most important point. Base64 has no key and no secret; anyone can decode it instantly. Seeing dXNlcjpwYXNzd29yZA== in a header or config file is the same as seeing user:password in plain text. That's why HTTP Basic authentication must only be used over HTTPS, and why passwords, API keys and personal data should never be "hidden" with Base64. Use real encryption, or keep secrets out of the data entirely.

When to use Base64, and when not to

  • Use it to put small binary data, like icons or short files, into text formats such as JSON, XML or HTML.
  • Avoid it for large images on websites. A Base64 image is a third larger and can't be cached separately from the page. Serve a normal image file instead, ideally in WebP.
  • Avoid it as security, obfuscation or compression. It makes data bigger, not smaller.

Base64 vs Base64URL

Standard Base64 uses + and /, which have special meanings in URLs. Base64URL replaces them with - and _ and usually drops the = padding. JWTs and many web APIs use Base64URL. The Utivaro tool uses standard Base64; to decode Base64URL, swap - back to + and _ to /, and add = until the length is a multiple of 4.

Frequently asked questions

Why does Base64 end with = or ==?

Padding. One = means the last group had 2 bytes of input; == means it had 1. Some systems omit padding.

Can Base64 be decoded without a key?

Yes. There is no key. Anyone can decode Base64, so it offers no protection.

Why is my decoded text garbled?

The text was probably encoded in a different character set than UTF-8, or the string is Base64URL rather than standard Base64.

Does the Utivaro tool send my data anywhere?

No. Encoding and decoding run in your browser.

Related

Sources