What Is Base64 Encoding?
Base64 is a way to represent binary data (images, files, raw bytes) as a string of plain text using 64 printable characters: A–Z, a–z, 0–9, +, and /. The name comes from the 64-character alphabet it uses.
Because Base64 output contains only safe text characters, it can be transmitted through systems that only handle text — email protocols, JSON APIs, HTML attributes, and more.
Common Uses for Base64
- Email attachments — MIME encodes binary attachments in Base64 so they can travel through text-only mail systems
- Embedding images in HTML/CSS —
src="data:image/png;base64,iVBORw0KGgo..." embeds images directly, eliminating HTTP requests
- API payloads — JSON doesn't support binary; Base64 is the standard way to include file content in JSON
- JWT (JSON Web Tokens) — The header and payload sections are Base64Url encoded
- HTTP Basic Authentication — Credentials (
username:password) are Base64 encoded in the Authorization header
How to Encode or Decode Base64 Online
Use tool.tl Base64 Encoder or Base64 Decoder:
- Go to tool.tl/base64-encoder (to encode) or tool.tl/base64-decoder (to decode)
- Paste your text or upload a file
- The result appears instantly
- Click "Copy" to use the output
Base64 Encoding Examples
| Original Text | Base64 Encoded |
|---|
| Hello | SGVsbG8= |
| Hello, World! | SGVsbG8sIFdvcmxkIQ== |
| tool.tl | dG9vbC50bA== |
| 123456 | MTIzNDU2 |
The trailing = or == characters are padding — they ensure the encoded string length is always a multiple of 4.
Base64 vs URL Encoding
| Base64 | URL Encoding |
|---|
| Purpose | Binary data → safe text | Special chars → %XX in URLs |
| Output charset | A-Za-z0-9+/= | Original chars + %XX escapes |
| Readability | Not human-readable | Partially readable |
| Size impact | ~33% larger | Varies by special char count |
| Typical use | File transfer, image embedding | URL query parameters |
Base64Url — The JWT Variant
Standard Base64's + and / characters are unsafe in URLs. Base64Url substitutes + → - and / → _, and drops the = padding. This is what JWT uses. Use the JWT Debugger to decode and inspect JWT tokens.
Base64 in Code
# Python
import base64
encoded = base64.b64encode(b'Hello').decode() # 'SGVsbG8='
decoded = base64.b64decode('SGVsbG8=').decode() # 'Hello'
// JavaScript
const encoded = btoa('Hello'); // 'SGVsbG8='
const decoded = atob('SGVsbG8='); // 'Hello'
# Shell
echo -n 'Hello' | base64 # SGVsbG8=
echo 'SGVsbG8=' | base64 --decode # Hello
Frequently Asked Questions
No. Base64 is encoding, not encryption — it provides zero security. Anyone can decode it instantly. For secure transmission, use actual encryption (AES, RSA, TLS). Base64 only makes binary data text-safe for transport.
Why does Base64 make data larger?
Base64 represents every 3 bytes of binary data as 4 characters, which means encoded output is approximately 33% larger than the original. For large files, this overhead matters for storage and bandwidth.
How can I tell if a string is Base64 encoded?
Base64 strings only contain A–Z, a–z, 0–9, +, /, and optional trailing = padding. The length is always a multiple of 4. But these are just heuristics — the only reliable check is to decode it and see if the result makes sense.
What's the difference between Base64 and Base64Url?
Base64Url replaces + with - and / with _, and omits = padding. This makes it safe to use in URLs and filenames. JWT always uses Base64Url, not standard Base64.