Base64 Glossary

A to C

Alphabet

The set of characters an encoding writes, in index order. Standard Base64 uses A-Z, a-z, 0-9, + and /, so A means 0 and / means 63. See the alphabet table.

ASN.1

Abstract Syntax Notation One, a language for describing data structures, used by X.509 certificates, keys and many telecom protocols. ASN.1 defines the structure. Encoding rules such as DER define the bytes.

Base16

The RFC 4648 name for hex: each byte becomes two characters from 0-9 A-F. It doubles the size. Try the Base16 tool.

Base32

An encoding with 32 characters (A-Z and 2-7 in RFC 4648) that turns 5 bytes into 8 characters, 60% larger than the input. Case-insensitive alphabets make it a good fit for TOTP secrets and DNS names. Try the Base32 encoder.

Base45

Defined in RFC 9285, it turns 2 bytes into 3 characters from the 45-character set that QR codes store in alphanumeric mode. The EU Digital COVID Certificate used it. Try the Base45 encoder.

Base58

Bitcoin’s alphabet of 58 characters: Base64 without 0, O, I, l, + and /. It converts the whole input as one big number, and each leading zero byte becomes a 1. Try the Base58 encoder.

Base58Check

Base58 with a version byte in front and a 4-byte checksum at the end. The checksum is the first 4 bytes of SHA-256 applied twice. Legacy Bitcoin addresses and WIF private keys use it. See the Base58Check tool.

Base64

A binary-to-text encoding that writes every 3 bytes as 4 characters from a 64-character alphabet, padding the end with =. Output is about 33% larger than the input. Start with the encoder and decoder, or read how Base64 works.

Base64URL

Base64 with - and _ in place of + and /, from section 5 of RFC 4648. Padding is often omitted. Used in JWTs and URLs. See Base64 vs Base64URL and the Base64URL encoder.

Base85

A family of encodings that write 4 bytes as 5 characters, 25% overhead. Ascii85 (Adobe, used in PDF and PostScript), Z85 (ZeroMQ) and the RFC 1924 alphabet used by git are the common variants. Try the Base85 tool.

Base91

basE91, created by Joachim Henke, uses 91 printable ASCII characters and packs 13 or 14 bits into each pair of characters. That puts its overhead between about 14% and 23%, the lowest here, at the cost of an alphabet that includes the double quote and many other punctuation characters. Try the Base91 tool.

Basic Auth

HTTP Basic authentication (RFC 7617) sends user:password in Base64 in the Authorization header: Aladdin:open sesame becomes Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==. Anyone who sees the header can decode it, so it needs HTTPS. Build or read one with the Basic Auth generator and decoder.

Binary-to-text encoding

Any scheme that represents arbitrary bytes using only printable characters, so the data survives systems built for text such as email, JSON or URLs. Hex, Base32, Base64, Base85, uuencode and quoted-printable are all binary-to-text encodings. Compare them in Base64 vs hex, Base32, Base58 and Base85.

BOM

Byte order mark, the character U+FEFF placed at the start of a text file. In UTF-8 it is EF BB BF (Base64 77u/), in UTF-16LE FF FE. Decoders that do not expect it show it as  or a stray invisible character.

Canonical encoding

The single “correct” encoded form of some data. In Base64 it requires the unused bits before the padding to be zero (RFC 4648, section 3.5): SGk/Pg== is canonical, SGk/Ph== decodes to the same bytes in lenient decoders but is not.

Charset

The character encoding that maps text to bytes, such as UTF-8, UTF-16LE or Windows-1252. Base64 stores bytes, so decoding Base64 to text requires knowing the charset the text was saved in. A wrong guess produces mojibake like Café. The Base64 to text tool lets you switch charsets.

CRLF

Carriage return plus line feed, the bytes 0D 0A. MIME requires CRLF between lines of Base64, while Unix tools usually write only LF (0A). Both are ignored by lenient decoders and rejected by strict ones.

CSP nonce

A random value in a Content-Security-Policy header (script-src 'nonce-…') that allows only inline scripts carrying the same nonce attribute. It is written in Base64, must be new for every response and should contain at least 128 bits of randomness. Generate one with the CSP nonce generator.

D to J

Data URI

A URL that carries the data itself instead of pointing to it, defined in RFC 2397: data:image/png;base64,iVBORw0KGgo…. Useful for small images and icons in HTML and CSS. See the data URI generator, the parser and data URI performance.

Deflate

The compression algorithm (RFC 1951) inside ZIP, gzip, zlib and PNG. “Raw deflate” means the compressed stream with no header or checksum around it. Compress and encode with the zlib and deflate tool.

DER

Distinguished Encoding Rules, the strict binary encoding of ASN.1 structures defined in ITU-T X.690. Certificates and keys are DER bytes. A DER structure usually starts with 30 (a SEQUENCE), which is why PEM bodies start with M, often MII.

gzip

A file format (RFC 1952) that wraps deflate-compressed data with a 10-byte header and a CRC-32 checksum. It starts with the bytes 1F 8B, so gzip in Base64 starts with H4sI. Use gzip and Base64 to compress and decode gzip Base64 to reverse it.

Hex

Hexadecimal: each byte written as two digits from 0-9 and a-f, for example 48 65 6c 6c 6f for Hello. It is easy to read byte by byte and twice the size of the input. Convert with Base64 to hex and hex to Base64.

JWE

JSON Web Encryption (RFC 7516). An encrypted token whose compact form has five Base64URL parts: header, encrypted key, initialization vector, ciphertext and authentication tag. Unlike a JWS, the content cannot be read without the key.

JWS

JSON Web Signature (RFC 7515). A signed message with three Base64URL parts: header, payload and signature. The payload is readable by anyone. The signature only proves it was not changed.

JWT

JSON Web Token (RFC 7519), a set of claims in JSON carried inside a JWS or JWE. Most JWTs you meet are JWS tokens that start with eyJ. Decode one with the JWT decoder, create one with the JWT encoder, and read Base64 in JWT.

L to Q

Line wrapping

Inserting line breaks into long Base64 output. MIME wraps at no more than 76 characters, PEM at exactly 64. GNU base64 wraps at 76 by default (-w 0 turns it off), openssl base64 at 64 (-A turns it off). The MIME encoder wraps for you.

Magic number

A fixed byte sequence at the start of a file that identifies its format, such as %PDF- for PDF or 89 50 4E 47 for PNG. Because Base64 encodes 3 bytes at a time, magic numbers turn into recognizable Base64 prefixes. See common Base64 prefixes and Base64 to file.

MIME

Multipurpose Internet Mail Extensions (RFC 2045 to 2049), the standard that lets email carry attachments and non-ASCII text. Its base64 Content-Transfer-Encoding is how attachments travel inside a text-only message. See Base64 in email and the EML decoder.

Padding

The = characters at the end of Base64 that fill the last 4-character group: == after 1 leftover byte, = after 2. Some formats drop it. Read the padding guide.

PEM

Privacy-Enhanced Mail, originally a secure email standard (RFC 1421). Today the name refers to its text format for keys and certificates: Base64 of DER bytes between -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- lines, wrapped at 64 characters (RFC 7468). Inspect one with the certificate decoder.

Quoted-printable

The other MIME transfer encoding. It keeps printable ASCII as is and writes other bytes as = plus two hex digits, so Café in UTF-8 becomes Caf=C3=A9. Efficient for mostly-ASCII text, wasteful for binary. Try the quoted-printable tool.

R to Z

Radix-64

OpenPGP’s name for its ASCII armor: standard Base64 plus an optional checksum line that starts with = and holds a CRC-24 in Base64. See Base64 standards.

SRI

Subresource Integrity, a browser feature that checks a downloaded script or stylesheet against a hash in the integrity attribute, written as the algorithm name plus the Base64 digest: sha384-…. Supported algorithms are SHA-256, SHA-384 and SHA-512. Generate values with the SRI hash generator.

uuencode

Unix-to-Unix encoding, a binary-to-text format older than MIME. Each line starts with a length character, and data characters come from ASCII 32 to 95, so it includes punctuation that MIME’s Base64 avoids. See the uuencode tool.

UTF-8

The dominant text encoding on the web. ASCII characters take one byte, other characters two to four. When a tool says “text to Base64”, it almost always means UTF-8 bytes to Base64: é is C3 A9. See UTF-8 to Base64.

UTF-16LE

UTF-16 with the low byte first, the internal string format of Windows and .NET. ASCII text in UTF-16LE has a zero byte after every character, so Hello becomes SABlAGwAbABvAA==, full of A. PowerShell’s -EncodedCommand expects it. See UTF-16 to Base64 and the PowerShell decoder.

Z85

ZeroMQ’s Base85 variant (ZeroMQ RFC 32). It encodes 4 bytes as 5 characters, avoids quotes and backslash so the output can sit in source code strings, and requires input in multiples of 4 bytes. Try the Z85 tool.

zlib

A thin wrapper (RFC 1950) around deflate data: a 2-byte header and an Adler-32 checksum. The header usually starts with 78, so zlib data in Base64 starts with eJ, eN, eF or eA depending on the compression level. Use the zlib tool.

FAQ