Base64 Encoder and Decoder

Encoding binary data for text-only channels

Many of the systems that carry data were designed before binary transports were reliable: email bodies, HTTP headers, JSON strings, XML documents, URLs and configuration files all assume text. Base64 bridges that gap by mapping every possible byte value onto a subset of printable ASCII. Once data is in that form it survives protocols that would otherwise mangle control characters, truncate at a null byte, or reject an unexpected byte entirely.

The three-to-four rule

The encoding works in groups of three input bytes, which is 24 bits, and rewrites them as four 6-bit values — each of which maps to one character in the 64-character alphabet. Three bytes in, four characters out: the encoded string is exactly four thirds the size of the input. When the input length is not a multiple of three, the final group is padded with equals signs so the output length stays a multiple of four.

It is encoding, not encryption

The most common misconception is that Base64 protects data. It does not. There is no key, no secret and no difficulty in reversing it — anyone can decode a Base64 string instantly, which is exactly why tokens containing personal data should never be trusted simply because they look scrambled. Security comes from encryption, and integrity comes from signatures and hashes; Base64 is transport formatting.

Why the URL-safe variant exists

Standard Base64 uses + and /. In a URL, + can be read as a space and / is a path separator; in a filename, / is illegal on Unix-like systems. The URL-safe variant replaces them with - and _, and padding is frequently omitted because = is also awkward in query strings. JSON Web Tokens are the best-known user of this form, which is why a JWT's three parts can look like ordinary words separated by dots.

Practical pitfalls

Three problems account for most real-world Base64 failures. First, truncation: a string copied from a log or an email that lost its final characters will not decode, and the error usually appears at the end rather than where the damage is. Second, whitespace: MIME encoding wraps long strings onto multiple lines, and naive decoders treat those newlines as invalid input — this tool strips whitespace before decoding. Third, variant mismatch: decoding URL-safe input with a strict standard decoder fails on the very first - or _.

Where you meet it day to day

Email attachments are Base64 inside MIME parts. A data URL that embeds a small image in CSS or HTML is a Base64 payload in a string. A PNG or PDF that has been pasted into a JSON field is Base64 because JSON has no byte type. Kubernetes secrets and many CI variables hold Base64-encoded values, which is convenient for transport and meaningless as protection — a point worth remembering when reviewing configuration.