How Base64 Encoding Works

Base64 shows up everywhere binary data has to travel through a text only channel, like email bodies, data URIs, and JSON fields. It looks cryptic, but the scheme is a simple, fixed rearrangement of bits that anyone can follow once the math is laid out.

Three bytes become four characters

The core idea is a change of grouping. Raw bytes are eight bits each. Base64 re chunks the bit stream into groups of six bits instead, and each six bit group names one character from a fixed alphabet.

Why six? Because 2 to the power of 6 is 64, so six bits map cleanly to 64 possible symbols, all of which are safe printable characters. The arithmetic works out neatly: 3 bytes are 24 bits, and 24 bits divide into exactly 4 groups of 6. So every 3 input bytes produce 4 output characters.

Take the bytes for Man (M=77, a=97, n=110):

M        a        n
01001101 01100001 01101110   three bytes, 24 bits
010011 010110 000101 101110  regrouped into four 6-bit values
19     22     5      46       their values
T      W      F      u        the alphabet characters

So Man encodes to TWFu. Decoding reverses the steps: four characters back to 24 bits back to three bytes.

The alphabet and padding

The 64 symbols are the uppercase letters A to Z, the lowercase a to z, the digits 0 to 9, and finally + and /. Index 0 is A, index 25 is Z, 26 is a, and so on.

Input is rarely an exact multiple of three bytes, so the last group may be short. Base64 handles this with the = padding character:

3 leftover bytes, no padding.
2 leftover bytes, one =.
1 leftover byte, two ==.

Padding keeps the output length a multiple of four so a decoder knows where groups end.

A note on the + and / characters: they are unsafe in URLs and filenames, which is why a variant swaps them for - and _. That variant is covered in URL safe Base64.

Why output grows about a third

Since 3 bytes of input become 4 characters of output, the size ratio is 4 to 3, an increase of roughly 33 percent. A 300 KB image becomes about 400 KB of Base64 text, before padding and any line breaks are added. This is the price of squeezing binary through a text channel, and it is a predictable, fixed overhead, not a surprise.

It is encoding, not encryption

The most important point for security: Base64 provides no confidentiality whatsoever. The mapping is public and fixed, with no key involved. Anyone can decode TWFu back to Man in a second. Base64 only makes binary data survive transport as text; it hides nothing. Never use it to protect secrets. This is worth stressing because the output looks scrambled enough to fool people, as explained in Base64 is not encryption.

To encode or decode something yourself, paste it into the Base64 Encoder / Decoder. The conversion runs entirely in your browser, so the input never leaves your device, which matters when the data is a token or a private file.

The takeaway: Base64 is a reversible repacking of bits into a 64 symbol alphabet, three bytes to four characters, with a steady one third size cost and zero secrecy. Use it to move binary through text, and reach for real encryption when you need to protect it.