Base64 is not encryption — it's encoding. If you paste Hello into a Base64 encoder and get SGVsbG8=, no secret key was used. The algorithm just translates binary data into 64 printable ASCII characters so it can travel through text-only channels like email, JSON, and URLs.
The Algorithm in Plain English
- Take your input bytes and group them in sets of 3 (24 bits total).
- Split those 24 bits into four 6-bit chunks.
- Each 6-bit value (0-63) maps to one character in the Base64 alphabet:
A-Z,a-z,0-9,+,/. - If the input isn't a multiple of 3 bytes, add
=padding to round it out.
For Hello (5 bytes), the encoder processes bytes 0-2 as one group (producing 4 characters), then bytes 3-4 as a 2-byte group (producing 3 characters + 1 =). Result: 8 characters — SGVsbG8=.
Where You Encounter Base64 Every Day
Data URIs — embed images directly in HTML/CSS asdata:image/png;base64,iVBOR..., saving HTTP requests for small icons.
JWT tokens — the payload section of every JSON Web Token is Base64-encoded JSON.
Email attachments — MIME uses Base64 to send binary files through text-only SMTP.
API authentication — Basic Auth encodesusername:passwordas a Base64 string in theAuthorizationheader.
Inline SVGs — embed vector graphics in a single HTML file without external dependencies.
Common Gotchas
Standard vs URL-safe. Standard Base64 uses + and /, which break in URLs. URL-safe Base64 replaces them with - and _ and strips the = padding. If you are encoding something for a query string, always use the URL-safe variant.
Base64 expands data by ~33%. Encoding 1 MB of binary produces ~1.33 MB of text. For large payloads, gzip the original data before Base64-encoding to offset the bloat.
It is not encryption. Anyone can decode Base64 with zero effort. Never use it as a security measure — it provides exactly zero confidentiality.
Try it yourself: Base64 Encoder/Decoder — free, no signup, works entirely in your browser with no server uploads.
SOCIAL SHARE CARD GENERATOR