Base64 & Data Encoding Explained
What Base64, Base32, Base58, Base62, Hex, Octal and Punycode encodings are, how they differ, and when to use each — with the difference between encoding and encryption.
Last updated: 26 July 2026
Encoding transforms data from one representation to another so it can travel safely through a channel that only accepts certain characters. It is not encryption — encodings are fully reversible by anyone and add no secrecy. This guide covers the text/number encodings developers meet most.
Encoding vs encryption vs hashing
- Encoding (Base64, Hex, …) — reversible, no key, no secrecy. Purpose: safe transport/representation.
- Encryption (AES, RSA, …) — reversible only with a key. Purpose: confidentiality.
- Hashing (SHA-256, …) — one-way, not reversible. Purpose: fingerprints/integrity.
If you need to protect data, reach for encryption or hashing — never Base64.
The encodings
| Encoding | Alphabet | Size overhead | Typical use |
|---|---|---|---|
| Base64 | A–Z a–z 0–9 + / | ~33% | Data URIs, email (MIME), JWT, API payloads |
| Base64URL | A–Z a–z 0–9 - _ | ~33% | Tokens in URLs and filenames |
| Base32 | A–Z 2–7 | ~60% | Case-insensitive IDs, TOTP secrets |
| Base58 | Bitcoin (no 0 O I l) | ~37% | Crypto addresses, human-typed IDs |
| Base62 | 0–9 A–Z a–z | ~34% | Short URLs, compact IDs |
| Hex | 0–9 a–f | 100% | Hashes, colours, byte dumps |
| Octal | 0–7 | ~167% | Unix file permissions, legacy |
| Punycode | ASCII (xn–) | varies | Internationalised domain names (IDN) |
Base64
The workhorse. It maps every 3 bytes (24 bits) to four 6-bit characters, padding the last group with =. Because the output is plain ASCII, you can drop binary data straight into JSON, HTML, CSS (data: URIs) or email. Remember the ~33% size cost and that it offers zero security.
Hex (Base16)
Two hex digits per byte — verbose but perfectly readable. You’ll see it in hashes, colour codes (#3b82f6), MAC addresses and hex dumps.
Base32 / Base58 / Base62
Trade-offs on the same idea: Base32 is case-insensitive and typo-resistant (used for TOTP secrets); Base58 drops look-alike characters for human copying (Bitcoin); Base62 is the most compact URL-safe option (short links).
Punycode
Lets Unicode domain names live in the ASCII-only DNS. münchen becomes mnchen-3ya, and a full internationalised domain is prefixed with xn--. Browsers show the Unicode; DNS stores the punycode.
Practical tips
- Use Base64URL for anything that goes in a URL or filename.
- Don’t Base64 to “hide” data — it’s trivially decoded.
- Hex is best when a human needs to read individual bytes; Base64 when size matters.
- All the encoders/decoders below run entirely in your browser — nothing you paste is uploaded.
References
- RFC 4648 — Base16, Base32 and Base64 data encodings.
- RFC 3492 — Punycode for internationalised domain names.
- MDN: btoa() — Base64 in the browser.
Frequently asked questions
Is Base64 encryption?
No. Base64 is an encoding, not encryption. It scrambles nothing and provides no security — anyone can decode it instantly. Never use Base64 to protect secrets; use real encryption (e.g. AES) for that.
Why does Base64 make data bigger?
Base64 represents every 3 bytes as 4 ASCII characters, so the output is about 33% larger than the input. That's the cost of making binary data safe to embed in text-only channels.
What is Base64 used for?
Embedding binary data in text contexts — data URIs (images in CSS/HTML), email attachments (MIME), JWT parts, and API payloads that must be plain ASCII.
What's the difference between Base64 and Base64URL?
Base64URL replaces the + and / characters with - and _ and usually drops the = padding, so the result is safe to put in URLs and filenames. The bytes it represents are identical.
When would I use Base58 or Base62?
Base58 (used by Bitcoin) removes visually ambiguous characters (0, O, I, l) and is good for human-copied identifiers. Base62 (0-9A-Za-z) is compact and URL-safe, common for short IDs and URL shorteners.