base64_encode
Encodes binary or text data as an ASCII-safe MIME base64 string.
base64_encode(string $string): string- Added in PHP 4.0
Parameters
| Parameter | Type | Description |
|---|---|---|
$string | string | The data to encode. May contain arbitrary binary bytes. |
Return value
stringThe base64-encoded data as a string, padded with = to a multiple of four characters.
Errors
Never throws; a TypeError is raised only if a non-stringable value is passed.
base64_encode() turns arbitrary bytes into the 64-character alphabet A-Z a-z 0-9 + /, padded with =. The point is transport: base64 output survives systems that are not 8-bit clean, such as mail headers, JSON string values, XML text nodes and HTML attributes.
When to reach for it
- Embedding a small image or font directly in CSS or HTML as a
data:URI. - Putting raw binary — an encrypted blob, a signature, a hash digest — into a JSON payload or a database text column.
- Building an HTTP Basic
Authorizationheader fromuser:password.
What trips people up
Base64 is encoding, not encryption. Anyone can reverse it instantly, so it protects nothing. It also grows the payload by roughly 33%, plus padding, which matters when you inline large images.
The standard alphabet contains + and /, both of which are meaningful inside a URL, and =, which is meaningful inside a query string. If the encoded value goes into a URL or filename, either pass it through rawurlencode() as well, or convert it to the URL-safe variant with strtr().
Example
When to use it
- Build the value for an HTTP Basic Authorization header from a username and password
- Inline a small logo in CSS as a data: URI so it costs no extra request
- Store an encrypted binary blob from openssl_encrypt() in a text database column
- Send raw file bytes inside a JSON API request body
Frequently asked questions
Is base64_encode secure or a form of encryption?
No. Base64 is a reversible encoding with no key, so anyone can decode it with base64_decode(). Use openssl_encrypt() or sodium_crypto_secretbox() when you actually need secrecy.
How much bigger does base64 make my data?
About 33% bigger, since every 3 bytes become 4 characters, plus up to 2 padding characters. A 3 MB image becomes roughly a 4 MB string.
Why does my base64 string break when I put it in a URL?
The standard alphabet includes +, / and =, which have special meaning in URLs. Run the result through rawurlencode(), or use the base64url variant by translating + to - and / to _.
More examples
Encoding real binary bytes
Bytes 0x00 and 0xFF are unprintable and would be mangled in a text channel. base64_encode turns them into the printable string AAH/, and decoding gives back the identical three bytes, which the strict === comparison confirms.
<?php
$binary = "\x00\x01\xff";
$encoded = base64_encode($binary);
echo $encoded, "\n";
echo bin2hex(base64_decode($encoded)), "\n";
var_dump(base64_decode($encoded) === $binary);URL-safe base64
The standard output contains + and / which break inside a URL path or query. Translating them to - and _ and stripping the = padding gives the base64url form used by JWTs; the reverse translation restores the padding and decodes to identical bytes.
<?php
$token = base64_encode("\xfb\xff\xbe tokens");
echo "standard : $token\n";
$urlSafe = rtrim(strtr($token, '+/', '-_'), '=');
echo "url-safe : $urlSafe\n";
// Reverse: restore padding, then translate back.
$restored = strtr($urlSafe, '-_', '+/');
$restored .= str_repeat('=', (4 - strlen($restored) % 4) % 4);
var_dump(base64_decode($restored) === base64_decode($token));A data: URI for an inline image
The file is read as raw bytes and re-encoded into a data: URI that a browser can render without a second HTTP request. The printed length shows the cost: the URI is 78 characters, noticeably longer than the 42-byte GIF itself.
<?php
// One-pixel transparent GIF, written and read back locally.
$gif = base64_decode('R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7');
file_put_contents('pixel.gif', $gif);
$uri = 'data:image/gif;base64,' . base64_encode(file_get_contents('pixel.gif'));
echo substr($uri, 0, 40), "...\n";
echo strlen($uri), " characters\n";
unlink('pixel.gif');
Discussion