Base64 Cheatsheet — Encoding Reference & Quick Guide
A concise Base64 reference: encoding table, URL-safe variants, use cases, and code snippets for JavaScript, Python, and Node.js. Printable and shareable.
base64 cheatsheet
base64 reference
base64 encoding table
base64 quick guide
base64 cheat sheet
What is Base64?
| Syntax / Pattern | Meaning | Example / Notes |
|---|---|---|
| Purpose | Encode binary data as ASCII text | Used in email attachments, JWT, data URIs |
| Alphabet | A–Z, a–z, 0–9, +, / (64 chars) | URL-safe uses - and _ instead of + and / |
| Padding | = or == appended to reach multiple of 4 | Some implementations strip padding |
| Ratio | 3 input bytes → 4 output chars | Output is ~33% larger than input |
Standard vs URL-Safe
| Syntax / Pattern | Meaning | Example / Notes |
|---|---|---|
| Standard Base64 | Uses + and / | Must be percent-encoded in URLs |
| Base64url (URL-safe) | Uses - and _ instead of + and / | Used in JWTs, URL params, filenames |
| Padded | Trailing = padding included | Required for standard RFC 4648 |
| Unpadded | Trailing = removed | Used in Base64url for JWTs |
JavaScript / Browser
| Syntax / Pattern | Meaning | Example / Notes |
|---|---|---|
| Encode (browser) | btoa("hello world") | Returns "aGVsbG8gd29ybGQ=" |
| Decode (browser) | atob("aGVsbG8gd29ybGQ=") | Returns "hello world" |
| Unicode encode | btoa(unescape(encodeURIComponent(str))) | Handles Unicode chars |
| URL-safe encode | btoa(s).replace(/\+/g,"-").replace(/\//g,"_").replace(/=/g,"") | Remove + / and padding |
Node.js
| Syntax / Pattern | Meaning | Example / Notes |
|---|---|---|
| Encode | Buffer.from('hello').toString('base64') | Returns 'aGVsbG8=' |
| Decode | Buffer.from('aGVsbG8=', 'base64').toString('utf8') | Returns 'hello' |
| URL-safe encode | Buffer.from(str).toString('base64url') | Node 16.7+ supports base64url directly |
Python
| Syntax / Pattern | Meaning | Example / Notes |
|---|---|---|
| Encode | base64.b64encode(b'hello').decode() | Returns 'aGVsbG8=' |
| Decode | base64.b64decode('aGVsbG8=').decode() | Returns 'hello' |
| URL-safe encode | base64.urlsafe_b64encode(b'hello++') | Returns URL-safe variant |
| Decode URL-safe | base64.urlsafe_b64decode(encoded) | Matching decode function |
Common Use Cases
| Syntax / Pattern | Meaning | Example / Notes |
|---|---|---|
| Data URI (inline image) | data:image/png;base64,<encoded> | Embed images directly in HTML/CSS |
| JWT payload | header.payload.signature (Base64url) | Decode payload: atob(jwt.split(".")[1]) |
| HTTP Basic Auth | Authorization: Basic base64(user:pass) | NOT secure — use TLS |
| Email attachments | MIME Content-Transfer-Encoding: base64 | Standard for binary email attachments |
Frequently Asked Questions
Is Base64 the same as encryption?
No. Base64 is a reversible encoding scheme anyone can decode. It provides no security. Never use it to "hide" sensitive information — use AES-256 or similar encryption instead.
Why does Base64 output end with == or =?
Base64 encodes 3 bytes at a time into 4 characters. If the input length is not a multiple of 3, padding characters (=) are added to make the output length a multiple of 4.
What is the difference between Base64 and Base64url?
Base64url replaces + with - and / with _ to make the output safe for use in URLs, JSON, and filenames without percent-encoding. It also often removes the trailing = padding.
Ready to put this to use?
Test patterns interactively in our live tool.