Quick answer: Base64 turns any bytes into a string of 64 safe characters so binary data can travel through text-only channels. URL encoding, also called percent-encoding, replaces characters that have special meaning in a URL with a % sign and two hex digits. Neither one is encryption: anyone can reverse them.
Try the free Encode & Decode Toolkit
Free, no sign-up, and built by the author of this guide.
Open the Encode & Decode ToolkitHow Base64 works
Base64 is defined in RFC 4648. The encoder takes the input three bytes (24 bits) at a time and splits them into four 6-bit groups. Each group picks one character from the alphabet A–Z, a–z, 0–9, + and /.
- Every 3 input bytes become 4 output characters, so encoded data is about one third larger.
- When the input length is not a multiple of 3, the output is padded with one or two
=signs. - The URL-safe variant, base64url (RFC 4648 section 5), uses
-and_instead of+and/, and padding is often left off. JWTs use this variant.
Base64 is common in email attachments (MIME), data: URIs, HTTP Basic authentication headers, Kubernetes Secrets and PEM certificate files.
How URL encoding works
Percent-encoding is defined in RFC 3986. Characters such as / ? # & = separate the parts of a URL, so a value that contains them must be encoded to be read as data. The text is first converted to UTF-8 bytes, then each byte that is not allowed is written as % plus two hex digits. Letters, digits and - . _ ~ are never encoded.
A space becomes %20. In HTML form submissions (application/x-www-form-urlencoded), a space is written as + instead, which is why you see both in query strings.
When to use which
| Situation | Use |
|---|---|
| Putting a search term or redirect address inside a query parameter | URL encoding |
| Sending binary data, such as an image or key, in JSON or a header | Base64 |
Building an HTTP Basic Authorization header | Base64 of username:password |
| Putting Base64 data inside a URL | base64url, or Base64 followed by URL encoding |
| Protecting a secret | Neither; use encryption |
Worked examples
| Operation | Input | Output |
|---|---|---|
| Base64 encode | Hello, World! | SGVsbG8sIFdvcmxkIQ== |
| Base64 encode | café | Y2Fmw6k= |
| URL encode | São Paulo | S%C3%A3o%20Paulo |
| URL encode | Jane Doe & Co | Jane%20Doe%20%26%20Co |
Hello, World! is 13 bytes. That is four full groups of 3 plus 1 leftover byte, so the output is 16 + 4 = 20 characters ending in ==. In café, the é takes two bytes in UTF-8 (C3 A9), so the input is 5 bytes. In São Paulo, ã becomes %C3%A3 for the same reason. Without encoding, the & in Jane Doe & Co would end the parameter early.
How to use the free Encode & Decode Toolkit
- Choose the Operation: Base64 encode, Base64 decode, URL encode or URL decode.
- Paste your text into the Input box.
- Select Convert. The result appears under Converted value.
- Select Copy result to copy it to the clipboard.
- If the input cannot be converted, "Conversion failed" appears with the browser's error message.
The conversion runs in your browser. A few details that affect the output:
- Base64 encode converts text to UTF-8 first, so accented letters and emoji work.
- Base64 decode expects the standard alphabet. For base64url input, replace
-with+and_with/first. The result is shown as UTF-8 text, so decoded binary data, such as an image, appears garbled. - URL encode uses JavaScript's
encodeURIComponent. It encodes everything except letters, digits and- _ . ! ~ * ' ( ), so it is meant for one value, not a whole URL. - URL decode does not turn
+into a space, and fails on a stray%that is not followed by two hex digits.
Common mistakes
- Treating Base64 as security. A Base64 password in a config file or Kubernetes Secret is readable by anyone who can see the file.
- Encoding a whole URL.
https://example.com/a?b=1becomeshttps%3A%2F%2Fexample.com%2Fa%3Fb%3D1, which is no longer a working link. Encode only the parameter values. - Double encoding. Encoding an already encoded value turns
%20into%2520. - Mixing the two Base64 alphabets, which causes decode errors or wrong bytes.
- Adding a trailing newline. Commands like
echoadd one unless you useecho -n, which changes the encoded result.
Frequently asked questions
Is Base64 encryption?+
No. Base64 is a reversible encoding with no key, so anyone can decode it. Use real encryption to protect data, and treat Base64 only as a way to carry bytes as text.
Why does Base64 end with = or ==?+
The equals signs are padding. They appear when the input length is not a multiple of three bytes: one = when two bytes are left over and == when one byte is left over.
Should a space be %20 or + in a URL?+
%20 is correct anywhere in a URL under RFC 3986. The + form is used only in form-encoded query strings, so use %20 unless you know the receiver expects form encoding.
Why is my decoded Base64 unreadable?+
The original data was probably binary, such as an image, a compressed file or a key, rather than text. It may also be base64url, which needs its - and _ characters converted before standard decoding.
How much larger does Base64 make data?+
Every three bytes become four characters, so encoded data is about 33 percent larger, plus any line breaks that some formats, such as MIME email, add.
Try the free Encode & Decode Toolkit
Put this guide into practice in your browser.
Open the Encode & Decode Toolkit