Base64 Cheat Sheet
How Base64 works, why it ends in =, the full alphabet, the URL-safe variant, how to recognise what's inside, and how to encode and decode in your language.
Updated 28 October 2026
Encode text or files, or decode Base64 back to text or a downloadable file.
Open the Base64 toolHow Base64 works
Base64 turns any bytes into 64 safe text characters. It takes 3 bytes (24 bits) at a time and writes them as 4 characters of 6 bits each, so the output is about 33% larger than the input. Base64 is an encoding, not encryption: anyone can decode it.
| Input | Bytes | Base64 | Why | |
|---|---|---|---|---|
M | 1 | TQ== | 1 byte → 2 characters + 2 padding | Try ↗ |
Ma | 2 | TWE= | 2 bytes → 3 characters + 1 padding | Try ↗ |
Man | 3 | TWFu | 3 bytes → 4 characters, no padding | Try ↗ |
Hello | 5 | SGVsbG8= | Try ↗ | |
Hello, World! | 13 | SGVsbG8sIFdvcmxkIQ== | Try ↗ |
Output length = 4 × ⌈bytes ÷ 3⌉. For example 100 bytes become 136 characters, and 1,000 bytes become 1,336.
The Base64 alphabet
| Value | Char | Value | Char | Value | Char | Value | Char |
|---|---|---|---|---|---|---|---|
| 0 | A | 16 | Q | 32 | g | 48 | w |
| 1 | B | 17 | R | 33 | h | 49 | x |
| 2 | C | 18 | S | 34 | i | 50 | y |
| 3 | D | 19 | T | 35 | j | 51 | z |
| 4 | E | 20 | U | 36 | k | 52 | 0 |
| 5 | F | 21 | V | 37 | l | 53 | 1 |
| 6 | G | 22 | W | 38 | m | 54 | 2 |
| 7 | H | 23 | X | 39 | n | 55 | 3 |
| 8 | I | 24 | Y | 40 | o | 56 | 4 |
| 9 | J | 25 | Z | 41 | p | 57 | 5 |
| 10 | K | 26 | a | 42 | q | 58 | 6 |
| 11 | L | 27 | b | 43 | r | 59 | 7 |
| 12 | M | 28 | c | 44 | s | 60 | 8 |
| 13 | N | 29 | d | 45 | t | 61 | 9 |
| 14 | O | 30 | e | 46 | u | 62 | + |
| 15 | P | 31 | f | 47 | v | 63 | / |
Padding is =. Each Base64 character carries 6 bits, so the value column is the character's 6-bit number.
Standard, URL-safe and MIME Base64
| Variant | Characters 62 and 63 | Padding | Used in |
|---|---|---|---|
| Standard (RFC 4648) | + / | = required | Email attachments, data: URLs, most APIs |
| URL-safe (base64url) | - _ | Usually left out | JWTs, URLs, file names |
| MIME | + / | = | Email — adds a line break every 76 characters |
| Data URL | + / | = | data:image/png;base64,iVBORw0KGgo… |
The Base64 tool detects URL-safe input and missing padding automatically when decoding.
What's inside? Common Base64 starts
| Base64 starts with | It's probably |
|---|---|
eyJ | JSON — e.g. a JWT header ({") |
iVBORw0KGgo | PNG image |
/9j/ | JPEG image |
R0lGOD | GIF image |
UklGR | WebP image (RIFF container) |
JVBERi0 | PDF document |
UEsDB | ZIP file (also .docx, .xlsx, .jar) |
H4sI | Gzip-compressed data |
PD94bWwg | XML (<?xml ) |
PHN2Zy | SVG image (<svg) |
Base64 in code
| Language | Encode | Decode |
|---|---|---|
| JavaScript (text) | btoa(String.fromCharCode(...new TextEncoder().encode(s))) | new TextDecoder().decode(Uint8Array.from(atob(b), c => c.charCodeAt(0))) |
| Node.js | Buffer.from(s).toString('base64') | Buffer.from(b, 'base64').toString() |
| Python | base64.b64encode(data) | base64.b64decode(b); URL-safe: urlsafe_b64encode |
| Java | Base64.getEncoder().encodeToString(bytes) | Base64.getDecoder().decode(b) |
| C# (.NET) | Convert.ToBase64String(bytes) | Convert.FromBase64String(b) |
| Go | base64.StdEncoding.EncodeToString(data) | base64.StdEncoding.DecodeString(b) |
| PHP | base64_encode($s) | base64_decode($b) |
| Command line | base64 file.bin or echo -n 'text' | base64 | base64 -d file.txt (macOS: base64 -D) |
JavaScript's btoa() only accepts Latin-1 text, so encode UTF-8 to bytes first, as shown — btoa('é😀') throws an error.
Gotchas
- Base64 is not encryption. Anyone can decode it. Don't use it to hide passwords or API keys.
- Size grows by a third. Inlining big images as Base64 data URLs makes pages slower; keep it for small icons.
- Unicode text needs UTF-8 first. Encode text to UTF-8 bytes before Base64, and decode the bytes as UTF-8 after.
- Standard vs URL-safe. A JWT segment uses
-and_and no padding; a standard decoder may reject it until you swap the characters and add=. - Line breaks. MIME Base64 wraps at 76 characters. Strip whitespace before decoding with strict decoders.
Frequently asked questions
Why does Base64 end with = or ==?
= is padding. Base64 works on 3-byte groups; if the last group has only 1 or 2 bytes, it's padded so the output length is a multiple of 4.How much bigger is Base64 than the original?
Is Base64 encryption?
What is the difference between Base64 and Base64URL?
+ and / for - and _ and usually drops the = padding, so the result is safe in URLs and file names. JWTs use it.