§ 4.1What Base64 is
Base64 writes any bytes using 64 safe characters (A–Z, a–z, 0–9, + and /). Every 3 bytes become 4 characters, so encoded data is about 33% larger. It is an encoding, not encryption — anyone can decode it, so never treat Base64 as a way to hide secrets.
§ 4.2Standard vs. URL-safe
| Standard (RFC 4648 §4) | Base64url (§5) | |
|---|---|---|
| Characters 62, 63 | + / | - _ |
| Padding | = to a multiple of 4 | Usually omitted |
| Seen in | Email (MIME), data: URLs | JWTs, URL parameters |
The decoder here accepts both, and adds missing padding for you.
§ 4.3Why decoded text sometimes looks like garbage
Base64 can carry any bytes — an image, a zip file, encrypted data. If the decoded bytes are not valid UTF-8 text, we show them as hexadecimal instead of pretending they are text. A PNG starts with 89 50 4e 47, a PDF with 25 50 44 46 (“%PDF”).
§ 4.QQuestions
Is Base64 secure?
No. It is reversible by anyone. Use real encryption for secrets.
Why does my Base64 end with = or ==?
Padding. The input length was not a multiple of 3 bytes, so 1 or 2 “=” fill the last group of 4 characters.
§ 4.RReferences
Last reviewed 2026-10-14.