If you have ever looked at an email source file and seen a long string of seemingly random letters and numbers like SGVsbG8gV29ybGQ=, you have encountered Base64. It is one of the most widely used encoding schemes in computing — and once you understand what it does and why, you will spot it everywhere.
Base64 is an encoding scheme that converts binary data into a string of printable ASCII characters. It uses exactly 64 characters: A–Z (26 characters), a–z (26 characters), 0–9 (10 characters), and the symbols + and /. A = sign is used as padding.
The name "Base64" comes directly from this: the data is represented in base 64, the same way decimal numbers are in base 10 and binary is in base 2.
Base64 is not encryption. It does not hide data or provide security. It is purely an encoding — a way to represent binary data as text so it can be safely transported through systems that only handle text.
Many systems and protocols were designed to handle text but not arbitrary binary data. Email protocols (SMTP), HTTP headers, HTML attributes, and JSON payloads all have this characteristic. When you need to include binary data — an image, a PDF, a compiled binary — in one of these text-only contexts, Base64 is the standard solution.
The key insight: any binary sequence can be represented as a Base64 string containing only printable, URL-safe characters. That string can travel through any text-only system without corruption.
When you attach a file to an email, your email client encodes it as Base64 before transmission. The email travels as plain text through SMTP servers, and the recipient's client decodes it back to the original file. This has been standard since the 1990s.
Instead of linking to an external image file, you can embed an image directly in CSS or HTML using a data URI:
background-image: url("data:image/png;base64,iVBORw0KGgo...");Small icons and logos embedded this way eliminate HTTP requests — useful for critical above-the-fold images where performance matters.
When an API or server uses Basic Auth, your username and password are combined (username:password) and Base64-encoded before being sent in the Authorization header:
Authorization: Basic dXNlcm5hbWU6cGFzc3dvcmQ=This is why Basic Auth requires HTTPS — Base64 is trivially reversible and provides no security on its own.
JSON only supports strings and numbers, not binary data. When APIs need to transfer files (PDFs, images, audio) inside a JSON payload, they Base64-encode the file and include it as a string field. This is common in webhook payloads, document scanning APIs, and email APIs.
To encode text to Base64 with Criply's free tool:
To decode a Base64 string back to text:
Encoding "Hello, World!":
Input: Hello, World!
Output: SGVsbG8sIFdvcmxkIQ==Encoding a URL for an API auth header:
Input: admin:secretpassword123
Output: YWRtaW46c2VjcmV0cGFzc3dvcmQxMjM=Note the = padding characters at the end. These ensure the output length is a multiple of 4 characters.
You can also encode binary files — images, PDFs, fonts — to Base64. Click "Encode a file instead" in the tool and upload any file. The tool reads it as binary and outputs the complete Base64 string, which you can embed in CSS, HTML, or a JSON payload.
One important note: Base64-encoded data is roughly 33% larger than the original file. For large files, this overhead is worth considering — embedding a 500 KB image as Base64 adds 667 KB to your HTML or CSS.
Is Base64 the same as encryption?
No. Base64 is trivially reversible by anyone. It provides no security whatsoever. Never use it to protect sensitive data.
Why does decoded Base64 sometimes look garbled?
If the original data was binary (an image, a PDF) rather than text, decoding to text will produce garbled characters because binary data is not valid UTF-8 text. The file upload feature encodes files to Base64; decoding those back produces binary, not readable text.
Use our free Base64 Encoder/Decoder tool — works in your browser, nothing to install.
Base64 Encoder/Decoder — Free