Base64 in Plain Words: What It Is and What It's For

September 4, 2026

Logs, emails, and settings regularly flash strings like SGVsbG8sIHdvcmxkIQ== — long, made of Latin letters and digits, with equal signs dangling at the end. It looks mysterious, but it's really just another way of writing ordinary text. Decode it and you get "Hello, world!".

Base64 is not encryption

The most common misconception: "the string is unreadable, so the data must be protected." No. Base64 is encoding, not encryption: there is no key, and anyone can decode the string in a fraction of a second. It wasn't invented for secrecy but for compatibility — so binary data could travel through channels that only understand text: legacy mail systems, URLs, XML, JSON.

How it works

The idea is simple: the data is cut into groups of 3 bytes (24 bits), and each group becomes 4 characters from a 64-symbol alphabet — Latin letters, digits, plus, and slash. If the last group runs short on bytes, = signs are added. Hence the distinctive look: the length is always a multiple of four, and one or two equal signs may hang off the end.

Example

cat → Y2F0
Hello, world! → SGVsbG8sIHdvcmxkIQ==
Hola → 0J/RgNC40LLQtdGC

By the way, look at the third line: Cyrillic letters produce a longer code, because the text is first converted to UTF-8, where each Cyrillic character takes two bytes.

Where you've already run into it

attachments in legacy email formats — images and files were shipped precisely as base64 text;
images embedded right in HTML and CSS: data:image/png;base64,... — a way to cut extra server requests for small icons;
the Authorization: Basic ... header in basic API authentication;
a JWT token — those three dot-separated parts, each base64url-encoded (a variant that uses "-" and "_" instead of "+" and "/").

How to encode and decode online

Open the Base64 encoder, paste your text, and press the button you need. You can decode other people's strings too — for example, the payload of a JWT token to see what data it carries (there's also a dedicated JWT decoder that pretty-prints the header and payload). And if you need to turn an image into a data URI, the image to Base64 converter is the tool for the job.

Spotted a string ending in "=" in a log? Don't panic about "encrypted data." It's almost certainly just base64, and decoding takes seconds. But you can't hide passwords or tokens from users this way — it isn't protection.

Base64 Encode / Decode

Encode text to Base64 or decode Base64 strings with full Unicode support

Base64 Image Encoder

Convert images to Base64 data URIs and back with drag & drop, file size comparison, and CSS/HTML copy

JWT Token Decoder

Decode JWT tokens to view header, payload, and signature as formatted JSON

Frequently asked questions

Why is base64 longer than the original text?

By a third: every 3 bytes of data become 4 characters, because only 64 «safe» symbols are used out of 256 possible byte values. Hence the 33% overhead — the price of sending binary data over text channels.

Is base64 encryption?

No, it is encoding: a reversible transformation with no secret key. Using base64 to «hide» a password or token is a security mistake — the encoded value is revealed by a single line of decoder code.

Can base64 be used in a URL?

Only the urlsafe variant: regular base64 contains «+» and «/», which get percent-encoded or break the link. The urlsafe version replaces them with «-» and «_».