Base64 Encoding Explained: What It Does and Does Not Do
A visual mental model for Base64, its size overhead, and the security mistake of treating encoding as encryption.
Why Base64 exists
Some channels are built to carry printable text more safely than arbitrary binary bytes. Base64 maps binary data into a restricted alphabet that is easy to embed in text protocols and data formats.
Why the output grows
Three input bytes are represented by four Base64 characters, so the encoded representation is roughly one third larger before other overhead.
It provides no secrecy
There is no secret key. Anyone can reverse the representation. Base64 can make data look unfamiliar, but obscurity is not confidentiality.
Where you see it
Email MIME parts, API payloads, HTTP authentication schemes, certificates and data URLs frequently use Base64 as a representation layer.
Use the right primitive
Need secrecy: encryption. Need integrity fingerprint: cryptographic hashing. Need printable representation: Base64.
A task you can work through
Encode the text “Hello” and decode it again: the result is the original text. Repeat with an Urdu or Arabic word to check that a tool handles UTF-8 bytes instead of assuming one byte per character. Base64 groups three input bytes into four printable characters, so a 3 MB binary payload is approximately 4 MB before JSON quoting or transport overhead. The exact result also depends on padding.
Where this approach fails
Anyone who receives Base64 can decode it. Putting an API key, password or private message in Base64 does not protect it. Base64 also does not prove authenticity or integrity; a string can be changed and re-encoded. Standard and URL-safe alphabets differ in two characters and padding conventions, which can matter when copying a value into a URL or token field.
Check the result before using it
Decode your output and compare the original text character by character. When exchanging values with another system, specify UTF-8 and whether it expects standard or URL-safe Base64. If a service asks for encryption, use its security mechanism rather than substituting Base64.
An exact round-trip
The browser tool converts Unicode text into UTF-8 bytes before Base64 encoding. Enter a short phrase that includes an accented letter or Arabic text, copy the encoded result into Decode and confirm you get the original phrase back. If another system produces a different encoded string, check whether it used UTF-8, inserted a newline or chose URL-safe Base64. A successful round-trip proves your text survived this path; it does not mean the data is confidential.
Try the related tool
Encode or decode Base64 text, unicode-safe. The tool page explains its implementation and limitations. Keep your original and inspect any important result.
Base64 Encode/Decode →Technical references
These external references explain the underlying formats or browser APIs. The worked examples above describe this site's specific tool behavior.