Can Base64 be decoded without a key?

Yes. There is no key. Decoding is a deterministic transformation available in every language and in any browser console, which is precisely why Base64 offers no confidentiality.

Why does Base64 make files bigger?

It represents every three bytes as four ASCII characters, a fixed 4:3 expansion of about 33%, plus padding. Encoding never reduces size.

What are the equals signs at the end of a Base64 string?

Padding that records how many bytes were missing from the final three-byte group. One equals sign means the group held two bytes; two means it held one.

Is a JWT encrypted because it looks like random characters?

No. A standard signed JWT is three URL-safe Base64 segments. The header and payload are readable by anyone; the signature only proves the token was not altered.

Explainers

What is Base64 encoding, and when should you actually use it?

Base64 turns binary into safe ASCII text. Here is how it works, why it is not encryption, and the three cases where it is the right tool.

By Mira Lindqvist, Tools engineer, Toolspea · Published 2026-05-28 · Updated 2026-08-01 · 6 min read

How the encoding works

Base64 reads the input three bytes at a time. Three bytes are 24 bits, which split evenly into four groups of six bits, and each six-bit group indexes a 64-character alphabet: A–Z, a–z, 0–9, plus and slash. When the input length is not a multiple of three, the final group is padded and one or two equals signs are appended to record how much padding was added.

That four-characters-per-three-bytes ratio is where the roughly 33% size increase comes from. It is a fixed overhead, not a compression trade-off.

Base64 is not encryption

This is the most common misunderstanding, and it appears in real production systems. Base64 has no key and no secret. Any string can be decoded by anyone who has it, using a single function call. If you find credentials Base64-encoded in a config file, treat them as plain text, because that is what they are.

Three legitimate uses

Base64 earns its place when a transport channel cannot carry raw bytes:

Data URIs: inlining a very small icon into CSS or HTML to remove one network request.
Text-only fields: putting a binary blob inside a JSON property or an HTTP header, which must be ASCII.
Email attachments: MIME has encoded attachments this way since the 1990s, and mail infrastructure still assumes it.

The URL-safe variant

Plus and slash both have meaning inside a URL, so the URL-safe alphabet substitutes hyphen and underscore and usually drops the padding. JSON Web Tokens use this variant, which is why a JWT decodes correctly with the URL-safe setting and produces garbage with the standard one.

When not to use it

Do not inline large images as data URIs. The encoded string cannot be cached separately, cannot be lazy-loaded, and inflates the HTML or CSS document that carries it — so the page gets slower rather than faster. Above a few kilobytes, a normal cacheable file wins.

Frequently asked questions

Tools mentioned

Base64 Encoder & Decoder — Convert text to Base64 and back, with UTF-8 handled correctly.
Image to Base64 — Convert an image into a data URI you can paste into CSS or HTML.
URL Encoder & Decoder — Percent-encode query values or decode an escaped URL.

Keep reading

Everything referenced in this article, plus the hubs and guides that go with it.

Base64 Encoder & DecoderToolConvert text to Base64 and back, with UTF-8 handled correctly.Image to Base64ToolConvert an image into a data URI you can paste into CSS or HTML.URL Encoder & DecoderToolPercent-encode query values or decode an escaped URL.Developer toolsCategory6 browser-based developer tools that never upload your files.Image toolsCategory3 browser-based image tools that never upload your files.robots.txt vs noindex: which one actually keeps a page out of GoogleGuideThe two directives control different things, and using the wrong one is why blocked pages keep appearing in search results.Why browser-based tools are safer than upload-based onesGuideWhat actually happens to a file you upload, and how client-side processing changes the risk for confidential material.Using the toolsFAQInput limits, supported formats, browser requirements and what to do when a tool behaves unexpectedly.