ToolHub
Encoding · 6 min read · Updated 2026
编码 · 阅读约 6 分钟 · 更新于 2026

When (and When Not) to Use Base64

何时使用（以及不该使用）Base64

Base64 is everywhere in modern software — in JSON Web Tokens, in email attachments, in CSS background images, in data URIs, in OAuth client secrets stored in config files. It is also one of the most misunderstood encodings. The single most common mistake is treating it as a form of encryption. It is not. This guide explains what Base64 is, when to use it, and when to use something else.

Base64 在现代软件中随处可见 —— JSON Web Token、邮件附件、CSS 背景图、Data URI、配置文件中的 OAuth 客户端密钥。它也是最容易被误解的编码方式之一。最常见的错误是把它当成加密。它不是。本指南会讲清楚 Base64 是什么、什么时候用、什么时候该用别的东西。

What Base64 actually does

Base64 到底做了什么

Base64 is a binary-to-text encoding scheme. It takes any sequence of bytes and represents it using only 64 safe ASCII characters: A–Z, a–z, 0–9, +, /, plus = for padding. The output is roughly 33% larger than the input. That is the entire mechanism — it is a reversible mapping with no secret and no key.

Base64 是一种二进制到文本的编码方案。它把任意字节序列用 64 个安全的 ASCII 字符表示：A–Z、a–z、0–9、+、/，加上 = 作为填充。输出比输入大约多 33%。仅此而已 —— 它是一种不带密钥、无需秘密的可逆映射。

You can try it right now with our Base64 encoder / decoder. Paste any text and see the encoded output.

可以用我们的 Base64 编码 / 解码工具 试试。粘贴任意文本，立刻看到编码结果。

Why use it at all?

为什么要用它？

The point of Base64 is to make binary data safe for text-only channels. Many protocols — JSON, XML, email bodies, URLs, HTTP headers — were designed for printable text and can break on raw bytes, especially null bytes, control characters, or non-ASCII data. Encoding the bytes as Base64 guarantees the channel can carry them intact. The recipient then decodes back to the original bytes.

Base64 的价值在于让二进制数据安全通过纯文本通道。许多协议 —— JSON、XML、邮件正文、URL、HTTP 头 —— 设计时只支持可打印文本，遇到原始字节（特别是空字节、控制字符或非 ASCII 数据）就可能出错。把字节编码为 Base64 后，通道就能完整传输，接收方再解码回原始字节。

Common real-world use cases

常见的实际用例

  • Data URIs in HTML and CSS. A small image can be embedded directly in a stylesheet as background-image: url(data:image/png;base64,...) to avoid a separate HTTP request.
  • HTML / CSS 中的 Data URI。 把小图片以 background-image: url(data:image/png;base64,...) 直接嵌入样式表，省一次 HTTP 请求。
  • Email attachments (MIME). SMTP only reliably transmits 7-bit ASCII, so binary attachments are Base64-encoded before sending.
  • 邮件附件（MIME）。SMTP 只能可靠传输 7 位 ASCII，附件在发送前需要 Base64 编码。
  • JSON Web Tokens (JWT). The header and payload are Base64URL-encoded so they can be safely placed in a URL or HTTP header.
  • JSON Web Token（JWT）。Header 和 Payload 用 Base64URL 编码，以便安全地放入 URL 或 HTTP 头。
  • Storing binary blobs in databases or text-based config files. Some legacy systems only accept text columns.
  • 在数据库或文本配置文件中存储二进制块。一些老系统只支持文本字段。
  • Basic authentication. The HTTP Basic auth header is Base64(username:password). This is one of the most dangerous uses of Base64, because people assume it is encrypted.
  • Basic 认证。HTTP Basic 认证头部是 Base64(username:password)。这是 Base64 最危险的用法之一，因为它让人误以为是加密。

What Base64 is not

Base64 不是什么

Base64 is not encryption. It is not a hash. It is not a signature. It is not a tamper detector. If you can decode it, anyone can decode it. The JWT spec is explicit: signing a JWT (e.g. with HMAC-SHA256) is what provides integrity and authenticity. The Base64 encoding only provides transport safety. If you put a secret in a JWT without a signature, anyone who reads the token can read the secret.

Base64 不是加密、不是哈希、不是签名、也不是防篡改手段。任何能解码的人都能解码。JWT 规范写得很清楚：JWT 的签名（例如用 HMAC-SHA256）才提供完整性和真实性，Base64 编码只解决传输安全。如果你把机密数据放进未签名的 JWT，任何拿到 Token 的人都能读出来。

If you need confidentiality, use a real cipher: AES-GCM, ChaCha20-Poly1305, or a well-audited library. If you need integrity, use HMAC or a digital signature. If you need both, use an authenticated encryption mode or a vetted protocol like TLS.

如果需要保密性，用真正的加密：AES-GCM、ChaCha20-Poly1305，或经过充分审计的库。如果需要完整性，用 HMAC 或数字签名。两者都要，就用带认证的加密模式或经过验证的协议（如 TLS）。

When to avoid Base64

何时不要用 Base64

  • Storing passwords. Use a slow password hash like Argon2id, bcrypt, or scrypt — never Base64, never a fast hash like SHA-256.
  • 存储密码。使用 Argon2id、bcrypt 或 scrypt 这类慢哈希 —— 永远不要用 Base64，也别用 SHA-256 这类快哈希。
  • Compressing data. Base64 makes data 33% larger. It is not a compression algorithm. Use gzip, brotli, or zstd instead.
  • 压缩数据。Base64 让数据增大 33%，不是压缩算法。需要压缩就用 gzip、brotli 或 zstd。
  • Obfuscating secrets. "Obfuscation" with Base64 is the same as publishing the secret. A motivated attacker reverses it in seconds.
  • 混淆机密。用 Base64"混淆"等于把机密公开。攻击者几秒就能解码。
  • Anywhere you can just send raw bytes. If your channel already supports binary (most modern APIs do), skip Base64 and send the bytes directly.
  • 任何可以直接传原始字节的场景。如果通道已经支持二进制（多数现代 API 都支持），就不必再用 Base64。

Variants worth knowing

值得了解的变体

Standard Base64 uses +, /, and = padding. URL-safe Base64 (sometimes called Base64URL) uses - and _ instead and omits padding. The two are not interchangeable. JWTs, for example, use Base64URL so the token can sit in a URL without further escaping. When in doubt, check the spec for the system you are integrating with.

标准 Base64 使用 +、/ 和 = 作为填充。URL 安全 Base64（有时叫 Base64URL）使用 - 和 _ 代替 +、/，并省略填充。两者不能直接互换。例如 JWT 使用 Base64URL，以便 Token 放在 URL 中时不需要额外转义。不确定时，看清楚你要集成的系统规范。

Bottom line

总结

Base64 is a small, elegant tool with a narrow job: making binary data safe for text channels. Use it for that, and pair it with real cryptography when you need confidentiality or integrity. The Base64 tool on ToolHub runs entirely in your browser — your text never leaves your device.

Base64 是个小而优雅的工具，工作范围很窄：让二进制数据通过文本通道。需要保密或完整性时，把它和真正的密码学结合使用。ToolHub 上的 Base64 工具 完全在浏览器中运行 —— 你的文本不会离开设备。