+ with -, / with _, and removes the padding = (RFC 4648 §5).How it works
Base64 represents data using 64 printable ASCII characters. Every 3 input bytes become 4 characters, which is why the result takes up about 33% more than the original.
It is neither encryption nor compression: it is a reversible encoding that anyone can decode. It is used to transport binary data over channels meant only for text.
The URL-safe variant (RFC 4648 §5) uses - and _ instead of + and /, and omits the = padding, so the result can be included in URLs and file names without escaping it.
Examples
Hello WorldSGVsbG8gV29ybGQ=CaféQ2Fmw6k=In UTF-8, non-ASCII characters take up more than one byte, which is why "é" adds two bytes.>>>?estándar: Pj4+Pw== · URL-safe: Pj4-PwThe URL-safe variant replaces + and / with - and _, and removes the = padding.Use cases
- Embed images, fonts, or icons directly in HTML/CSS via data URIs.
- Send email attachments (MIME) or binary data inside a JSON.
- Store keys, certificates, or tokens in environment variables and configuration files.
- Encode credentials for HTTP's Authorization: Basic header.
Frequently asked questions
Is Base64 an encryption method?
No. It is a reversible encoding with no key: anyone can decode it. It adds no security; to protect data you have to encrypt it.
Why does the result end in "="?
The "=" is padding to complete blocks of 4 characters when the input is not a multiple of 3 bytes. The URL-safe variant omits it.
When is the URL-safe variant preferable?
When the value goes in a URL, a file name, or an identifier, because the + and / characters have special meaning in those contexts.
Why is the encoded text longer than the original?
Because it uses 4 characters for every 3 input bytes, so the size grows by about 33%.
Is my text uploaded to a server?
No. The encoding and decoding happen entirely in your browser.