What Base64 is — and what it is not
Base64 is a binary-to-text encoding. Its job is to take arbitrary bytes — an image, a certificate, a token, a snippet of UTF-8 text — and re-express them using only 64 printable characters that survive channels built for plain text. Email (MIME), JSON payloads, data URIs and HTTP headers all assume text, so wrapping raw bytes in Base64 stops them from being mangled in transit. Crucially, it is not encryption: the transformation is public and reversible by anyone, so it hides nothing.
How the encoding works
The algorithm reads your input three bytes (24 bits) at a time and re-slices those 24 bits into
four groups of 6 bits. Each 6-bit group has 64 possible values (26), which maps neatly
onto the alphabet A–Z a–z 0–9 + /. When the input length is not a multiple of three,
the final group is padded and marked with = signs so the decoder knows how many real
bytes to recover.
A worked example
Take the three characters Man (ASCII bytes 77, 97, 110). As 24 bits that is
01001101 01100001 01101110. Re-grouped into 6-bit chunks: 010011,
010110, 000101, 101110 = 19, 22, 5, 46 — which index to
T, W, F, u. So Man encodes to
TWFu. Encode just M and you get TQ==: one real byte, two
padding characters.
Standard vs URL-safe vs related encodings
| Scheme | Alphabet | Size overhead | Typical use |
|---|---|---|---|
| Base64 (standard) | A–Z a–z 0–9 + / | ~33% | Email, data URIs, Basic auth headers |
| Base64 (URL-safe) | A–Z a–z 0–9 - _ | ~33% | JWTs, OAuth, query strings, filenames |
| Hex (Base16) | 0–9 A–F | 100% | Hashes, colours, memory dumps |
This tool handles the Unicode trap that breaks many encoders: before calling the browser's
native encoder it converts your text to UTF-8 bytes, so emoji and non-Latin scripts decode back
to exactly what you typed. Pick the URL-safe variant when the result must travel inside a URL,
cookie or filename, where a stray + or / would otherwise need escaping.
btoa and atob functions. Nothing you paste — tokens, auth headers,
personal data — is ever transmitted, logged or stored. Close the tab and it is gone.