Base64 encode & decode

What is Base64?

Base64 is a way of writing any data, including images, files or text in any language, using only 64 plain characters: the capital letters A–Z, the small letters a–z, the digits 0–9, and the symbols + and /. Some systems can only carry plain text safely. Base64 lets you send binary data through them without it getting damaged.

How it works, in one example

Base64 takes your data 3 bytes (24 bits) at a time and splits those 24 bits into four groups of 6 bits. Each 6-bit group is a number from 0 to 63, and each number maps to one character.

• The text Hi! is 3 bytes: 01001000 01101001 00100001.
• Split into 6-bit groups: 010010 000110 100100 100001, which is 18, 6, 36 and 33.
• Those numbers map to S, G, k and h, so Hi! becomes SGkh.

When the data doesn't divide evenly into 3 bytes, Base64 adds one or two = signs at the end as padding. For example, Hi becomes SGk=. Because every 3 bytes become 4 characters, Base64 output is about 33% bigger than the original.

Where you see Base64 at work

• Email attachments. Email was designed for text, so attached files are Base64-encoded inside the message.
• Images inside web pages. A data:image/png;base64,... address puts a small image straight into HTML or CSS.
• HTTP basic authentication. The browser sends username:password Base64-encoded in a header. This is why basic authentication must only ever be used over HTTPS.
• JSON Web Tokens (JWTs). The header and payload of a JWT use Base64url, a variant that uses - and _ instead of + and / so it is safe in web addresses.
• Certificates and keys. PEM files (the ones starting with -----BEGIN CERTIFICATE-----) are Base64 text.

Base64 is not encryption. There is no key and no secret, so anyone can decode it in a second. Never use it to hide passwords or secrets. In security work, attackers often use Base64 to disguise malicious commands, so decoding a suspicious Base64 string is a common first step when you investigate an alert.

Quick questions

Why does my Base64 end with = or ==?

That's padding. It shows the original data wasn't a multiple of 3 bytes. One = means 2 bytes were left over, and == means 1 byte was.

Why does decoding give strange characters?

The original data probably wasn't text, for example an image or a compressed file. It can also happen when the string uses Base64url characters (- and _). Try swapping them for + and /.

Is it safe to paste data into this tool?

Yes. The encoding and decoding happen in your own browser, and nothing you type is sent to FM TecHub or anyone else.