Base64 Encoder & Decoder

Base64 is a way of representing arbitrary binary data using only 64 printable ASCII characters — the upper- and lowercase letters, the digits 0–9, and two more symbols (+ and /, or - and _ in the URL-safe variant). It does this by regrouping the data’s bits: three bytes (24 bits) are reinterpreted as four 6-bit chunks, and each chunk is mapped to one character from the 64-character alphabet.

The result is longer than the original — about a third longer, since 4 output characters replace every 3 input bytes — but it can travel safely through systems that were only ever designed to carry plain text.

Base64’s origins are practical, not academic. Early internet protocols like SMTP (email) were built around 7-bit ASCII text and could mangle or strip anything outside that range — a problem the moment people wanted to attach a photo or a document to an email, since image and file data is arbitrary binary, not text. The MIME standard adopted Base64 in the early 1990s specifically to solve this: encode the attachment’s bytes as text, send it through the text-only pipe, decode it back to bytes on the other end.

The same underlying problem — a channel that only reliably carries text — shows up constantly in modern software, which is why Base64 outlived the email systems it was designed for.

Base64 is an encoding, not a cipher. It has no key, no secret, and nothing to keep private — anyone who sees the encoded string can decode it in a single step, using nothing more than a public, standardized lookup table. It exists purely to change the representation of data, not to protect it.

Treating Base64 as if it hid or secured data is a genuine, recurring security mistake, sometimes called "security by Base64." A password or API key that is merely Base64-encoded rather than encrypted is exactly as exposed as if it were sent in plain text — the encoding only changes what it looks like, not who can read it.