Base64 and URL encoding are two different ways of writing data so that it survives being sent through a system built for plain text. They look similar to beginners, but they solve different problems.

Base64: any data as safe text

Base64 turns bytes into text made from 64 safe characters: the letters A to Z and a to z, the digits 0 to 9, and + and /. Every 3 bytes become 4 characters, so the data grows by about one third. If the length is not a multiple of 3, the end is padded with one or two = signs.

Hello becomes SGVsbG8=.

It is used for email attachments, images embedded in web pages as data URIs, binary data inside JSON, and parts of login tokens.

URL-safe Base64

The characters + and / have special meaning in web addresses. The URL-safe variant swaps them for - and _, and often leaves out the = padding. You see it in tokens and file names. A decoder has to know which alphabet it is reading, which is why mixing the two in one string is an error.

Text and UTF-8

Base64 works on bytes, not letters. To encode text, the text is first turned into bytes, almost always using UTF-8. Characters such as é take two bytes and many emoji take four, so the Base64 text of "café" is longer than you may expect. Tools that skip this step fail on anything outside plain English letters.

URL encoding (percent-encoding)

A web address can safely contain only a limited set of characters. Everything else is written as a percent sign followed by two hexadecimal digits for each byte. A space becomes %20, & becomes %26, and é becomes %C3%A9.

There are three common modes:

  • Component: encodes everything special. Use it for one value, such as a search term inside a link.
  • Whole address: leaves the characters that give an address its structure (: / ? # & =), and encodes the rest.
  • Form data: the format used by web forms, where a space is written as +.

Encoding a whole address with the component mode breaks it, because the slashes and colons are encoded too. Use the right mode for the part you are encoding.

Common mistakes

  • Treating Base64 as encryption. It is not. Anyone can decode it in a second. Never use it to hide a password or private information.
  • Encoding twice. Applying percent-encoding two times turns %20 into %2520.
  • Wrong alphabet. Using standard Base64 in a place that expects URL-safe text.
  • Pasting line breaks. Email-style Base64 is split into lines of 64 or 76 characters. A good decoder ignores them.

Which one do you need?

If you are putting data into a link, use URL encoding. If you must carry binary data or arbitrary text through a text-only channel, use Base64. If you must hide data, use real encryption instead.

Try it

Switch between Base64 and URL, and between encode and decode. If the input is not valid, the tool says what is wrong. To turn an image into Base64, use the Image to Base64 tool.