Base64 encode and decode
Turn text into Base64 or Base64 back into text. For short inputs every step is drawn: the bytes in binary, the same bits cut into sixes, and the character each six picks.
Any text, including accents and emoji. It is turned into UTF-8 bytes first, and the bytes are encoded.
Step by step
Top to bottom: each byte, its 8 bits, the same bits cut into sixes, each six as a number from 0 to 63, and the Base64 character for that number. Colours follow each byte's bits into the sixes; grey bits are zeros added to fill the last six.
What Base64 is for
Some channels only carry text: email, URLs, JSON, HTTP headers, a line in a config file. Base64 lets any bytes through them, by writing the bytes with 64 characters that survive everywhere: the letters, the digits, + and /. You meet it in:
- Email attachments. MIME sends files as Base64, wrapped in lines of 76 characters.
- Data URLs, which put a small file straight into a web page: data:text/plain;base64,SGVsbG8= is a text file holding "Hello".
- HTTP basic authentication, which sends a user name and password as Authorization: Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==. That is "Aladdin:open sesame", readable by anyone who sees it, which is why it must only go over HTTPS.
- Keys and certificates in PEM files, and binary values inside JSON and XML.
Base64 is an encoding, not encryption. There is no key: anyone can decode it, so it hides nothing.
How Base64 works: 3 bytes become 4 characters
A byte is 8 bits and a Base64 character carries 6, since 26 = 64. Three bytes are 24 bits, which is exactly four sixes. So the encoder takes the bytes three at a time, writes out their 24 bits, cuts them into four groups of six, and looks each up in the alphabet. Here is the word "Man":
M, a and n are bytes 77, 97, 110. Their bits, 010011010110000101101110, cut into sixes are 010011 010110 000101 101110, which are 19, 22, 5, 46, and those are the characters T, W, F, u. So "Man" is TWFu. Decoding runs the same steps upwards. Text goes through UTF-8 first, so an emoji is four bytes before Base64 sees it.
The alphabet
The 64 characters in order: capitals for 0 to 25, small letters for 26 to 51, digits for 52 to 61, then + and /.
Padding: = and ==
When the bytes run out part way through a group of three, the last group is short. The encoder fills the last six with zero bits and adds = for each character that has no bits at all, so the output stays a multiple of four.
One byte left: two characters and ==
"M" is TQ==. 8 bits need two sixes, with 4 zero bits added.
Two bytes left: three characters and =
"Ma" is TWE=. 16 bits need three sixes, with 2 zero bits added.
The padding carries no information, since the length already says how the last group ends, so many systems leave it off. This decoder accepts Base64 with or without it, but not with the wrong number of = signs.
Printable Base64 alphabet chart
The full 64-character index table with each 6-bit value, plus padding and the URL-safe variant, on one sheet for printing.
Click to download: Base64 alphabet chart
How much bigger Base64 makes data
Every 3 bytes become 4 characters, so Base64 is a third bigger than the data, rounded up to a whole group of four.
| Bytes | Base64 characters | Without padding |
|---|---|---|
| 1 | 4 | 2 |
| 2 | 4 | 3 |
| 3 | 4 | 4 |
| 4 | 8 | 6 |
| 5 | 8 | 7 |
| 6 | 8 | 8 |
| 10 | 16 | 14 |
| 100 | 136 | 134 |
| 1,000 | 1,336 | 1,334 |
| 1,000,000 | 1,333,336 | 1,333,334 |
The rule: 4 × ⌈n ÷ 3⌉ characters for n bytes. Email adds a line break every 76 characters on top of that.
URL-safe Base64
In a URL, + can mean a space and / separates the parts of a path, and / cannot appear in a file name. URL-safe Base64, also called Base64URL, uses - for 62 and _ for 63 instead, and usually drops the padding. Everything else is the same. The bytes FB EF BE FF are ++++/w== in standard Base64 and ----_w in URL-safe Base64. JSON Web Tokens are three pieces of URL-safe Base64 joined by full stops.
Questions
Is Base64 encryption?
No. Base64 is an encoding: it has no key, and anyone can reverse it. "Aladdin:open sesame" encodes to QWxhZGRpbjpvcGVuIHNlc2FtZQ==, which looks scrambled but decodes straight back. Use it to carry bytes through a channel that only takes text, never to hide anything.
Why does Base64 end with = or ==?
Base64 turns every 3 bytes into 4 characters. When the input is not a multiple of 3 bytes, the last group is short: one leftover byte gives two characters and ==, two leftover bytes give three characters and =. The padding keeps the output a multiple of 4 characters long.
How much bigger does Base64 make data?
A third bigger: 4 characters for every 3 bytes, rounded up to a whole group. A 3 MB file becomes 4 MB of Base64, plus line breaks if it is wrapped for email.
What is the difference between Base64 and Base64URL?
URL-safe Base64 swaps the two characters that mean something in a URL or file name: + becomes - and / becomes _. It usually leaves off the = padding too. JSON Web Tokens use it. This decoder accepts either.
Why does decoding give strange characters?
The decoded bytes are shown as UTF-8 text. If the Base64 held an image, a compressed file or text in another encoding, the bytes are not UTF-8 text, and this page shows them in hex instead.
Why did my Base64 fail to decode?
Usually a character outside the alphabet (A–Z, a–z, 0–9, + and /, or - and _), a length that leaves one character over after the groups of four, which means something is missing, or = signs in the wrong place or number. The error names which one and where. Spaces and line breaks are ignored.
To see the bytes of a piece of text in binary, use the binary translator; for the codes of single characters, the ASCII table.