What Is Base64? Base64 Encoding Explained Bit by Bit, with Padding, Size and Variants

Why Base64 exists

Early email was built for 7-bit ASCII text. Gateways rewrapped long lines, converted line endings, stripped the eighth bit and treated some byte values as control codes. Send a JPEG through that and it arrives corrupted. The same problem appears today wherever binary data has to live inside a text format: an image in a JSON field, a certificate in an environment variable, a file in an XML document, a key in a YAML file.

Base64 solves it by choosing 64 characters that survive every one of those systems unchanged, and mapping any sequence of bytes onto them. It was standardised for privacy-enhanced mail (RFC 1421) and MIME email (RFC 2045), and the definition used today is RFC 4648.

How it works: three bytes become four characters

Base64 reads the input three bytes (24 bits) at a time and splits those 24 bits into four groups of 6 bits. Each 6-bit group is a number from 0 to 63, which selects one character from the alphabet. The classic example is the word Man:

text          M         a         n
ASCII         77        97        110
bits          01001101  01100001  01101110
regrouped     010011 010110 000101 101110
values        19     22     5      46
characters    T      W      F      u        ->  "TWFu"

Six bits is the key number: 2⁶ = 64, so every 6-bit value has exactly one character. Decoding reverses the process: look up each character's value, concatenate the 6-bit groups, and cut the bit stream back into bytes.

The alphabet

0-25   A-Z        0=A   1=B  ...  25=Z
26-51  a-z        26=a  27=b ...  51=z
52-61  0-9        52=0  ...       61=9
62     +
63     /
pad    =

The first 62 characters are letters and digits, which survive virtually every text system. The last two are the only real choice, and it is why variants exist. + and / have special meanings in URLs and file paths, so the URL-safe variant, Base64url, uses - and _ instead. Everything else about the two is identical.

Padding: what the = signs mean

When the input length is not a multiple of three, the last group is short. The encoder pads it with zero bits to complete the last character, then adds = signs so the output length stays a multiple of four.

"Man"  3 bytes  -> TWFu       no padding
"Ma"   2 bytes  -> TWE=       16 bits -> 3 characters + one =
"M"    1 byte   -> TQ==       8 bits  -> 2 characters + two =

So = can only appear at the end, and at most twice. One = means the last group held two bytes; two mean it held one. Some formats, including JWTs and most Base64url uses, drop the padding because the decoder can work it out from the length. A string whose length leaves a remainder of 1 when divided by 4 is never valid Base64. Characters are missing.

The size cost

Every 3 bytes become 4 characters, so Base64 output is 4/3 of the input, about 33% larger, rounded up to a multiple of four characters. MIME email adds a line break every 76 characters on top of that.

input         Base64 output
3 bytes       4 characters
1 KB          ~1.37 KB
1 MB          ~1.33 MB
exact:        4 × ceil(n / 3) characters for n bytes

Compression recovers a little of that when the Base64 text is sent with gzip or Brotli, but not most of it. Other encodings trade differently. Hexadecimal (Base16) doubles the size but is trivially readable. Base32 grows data by 60% but is case-insensitive, which is why TOTP secrets use it. Ascii85, used in PDF and PostScript, grows it by only 25%, but its alphabet includes quotes and backslashes that need escaping in most formats.

What Base64 is not

It is not encryption. There is no key, the alphabet is public, and anyone can decode a Base64 string in a second. "Base64 decrypt" is a common search, but there is nothing to decrypt. A password stored as Base64 is stored in plain text, and a Kubernetes Secret is only as secret as the access controls around it.

It is not compression. The output is always larger than the input.

It is not a text encoding. Base64 turns bytes into characters, but it does not decide which bytes represent your text. Encoding é as UTF-8 (C3 A9) gives w6k=; encoding it as Latin-1 (E9) gives 6Q==. The decoder must use the same text encoding as the encoder, or the result is garbled. UTF-8 is the right default.

Where you will see it

Data URIs (data:image/png;base64,iVBORw0…) embed images in HTML and CSS. Email attachments are Base64 inside MIME parts. HTTP Basic authentication sends username:password as Base64. PEM files wrap Base64-encoded DER certificates and keys between -----BEGIN and -----END lines. JWTs are three Base64url parts joined with dots. JSON APIs carry files, signatures and binary IDs in Base64 strings, because JSON has no binary type.

Two quick recognition tips: text that ends in one or two = signs and uses only the alphabet above is probably Base64, and Base64 of JSON starts with eyJ, because {" always encodes to those characters.

Sources and further reading

RFC 4648 (The Base16, Base32, and Base64 Data Encodings) is the current definition, including the URL-safe alphabet and padding rules. RFC 2045 defines MIME's Base64 with 76-character lines, and RFC 1421 is the earlier privacy-enhanced mail definition. MDN's Base64 glossary entry covers btoa(), atob() and the Unicode issue in browsers.

Frequently asked questions

What is Base64 encoding?

A way to represent any binary data using 64 printable ASCII characters (`A–Z`, `a–z`, `0–9`, `+`, `/`). Every 3 bytes become 4 characters, so the data can pass safely through text-only systems like email, JSON and HTTP headers.

Is Base64 encryption?

No. It has no key and anyone can decode it instantly. Use it to transport data, never to protect it.

Why does Base64 end with = or ==?

The `=` characters are padding. When the input length is not a multiple of 3 bytes, one or two `=` signs keep the output length a multiple of 4: one `=` means the final group had 2 bytes, two mean it had 1 byte.

How much bigger does Base64 make data?

About 33%: every 3 bytes become 4 characters, so the output is `4 × ceil(n / 3)` characters. MIME email adds line breaks every 76 characters on top.

What is the difference between Base64 and Base64url?

Base64url replaces `+` with `-` and `/` with `_` so the result is safe in URLs and file names, and it usually omits `=` padding. The encoding is otherwise identical.

Why is it called Base64?

Because it uses an alphabet of 64 characters, and each character represents 6 bits (2⁶ = 64), the same way base 10 uses ten digits.