Base64 Cheat Sheet
Base64 represents binary data using 64 printable ASCII characters, so anything — text, images, keys — can travel through channels that only tolerate text.
The essentials
| Fact | Detail |
|---|---|
| Alphabet | A–Z, a–z, 0–9, + and / (64 characters) |
| Padding | = pads the output so its length is a multiple of 4 |
| Size cost | Encoded output is ~33% larger than the input bytes |
| URL-safe variant | Uses - and _ instead of + and / (JWTs use this, unpadded) |
| Decodable? | Always, by anyone — Base64 is encoding, NOT encryption |
| Typical uses | Data URLs, email attachments (MIME), JWT payloads, embedding fonts |
CLI one-liners
| Task | Command |
|---|---|
| Encode text (macOS/Linux) | echo -n "hello" | base64 |
| Decode text | echo "aGVsbG8=" | base64 -d |
| Encode a file | base64 input.png > output.txt |
| Decode a file | base64 -d output.txt > input.png |
| URL-safe encode (Node.js) | Buffer.from(s).toString("base64url") |
FAQ
Is Base64 encryption?
No. Decoding requires no key — anyone can reverse it instantly. Never "protect" secrets by Base64-encoding them; that is obfuscation, and it fools nobody.
Why is the output bigger than the input?
Three bytes (24 bits) become four 6-bit groups, each written as a full character (8 bits): a 4/3 ratio, about +33%.
Why does my decoded string end in garbage?
Almost always trailing whitespace or a lost padding character. Make sure the = padding survived copying, and that URL-safe (-, _) variants are decoded with the right decoder.
Try it instead of memorizing it
Convert it locally in the Base64 Encoder