Base64 Encode & Decode
Convert text to Base64 and back, with full Unicode support and an option for the URL-safe alphabet used in JWTs and web addresses.
🔒 Runs entirely in your browser. Nothing you enter is sent to a server.
Base64 is everywhere in web development, even if you rarely notice it. It is inside data URLs, email attachments, HTTP Basic Auth headers, JSON Web Tokens and API payloads that need to carry binary data as plain text. This tool encodes text to Base64 and decodes it back, handling emoji and non-English characters correctly, which many simple converters get wrong.
How to use the Base64 tool
- Choose Encode or Decode.
- Paste your text or Base64 string into the input box. The result updates as you type.
- For tokens and URLs, choose the URL-safe alphabet.
- Copy the result, or click Use output as input to reverse it and check the round trip.
When decoding, whitespace and line breaks are ignored, and missing padding is added automatically. Both standard and URL-safe input are accepted.
How Base64 encoding works
Base64 takes your data 3 bytes (24 bits) at a time and splits it into four 6-bit groups. Each 6-bit value, from 0 to 63, maps to one character in a 64-character alphabet:
A–Z → 0–25 a–z → 26–51 0–9 → 52–61 + → 62 / → 63If the data doesn’t divide evenly into 3-byte blocks, the output is padded with one or two = signs. For example, the word Man becomes TWFu, and Ma becomes TWE=.
Why Unicode needs care
The browser’s built-in btoa() function only accepts characters in the Latin-1 range, so btoa("✓") throws an error. This tool first converts your text to UTF-8 bytes and then encodes those bytes. That is the same result you get from base64 on the command line or from most programming languages.
Common uses
- Data URLs: embed small images or fonts directly in CSS or HTML, as in
data:image/png;base64,.... - HTTP Basic Auth: the
Authorizationheader carriesusername:passwordencoded in Base64. Remember that this is encoding, not protection, so only send it over HTTPS. - JWTs: each of the three parts of a JSON Web Token is Base64URL-encoded JSON.
- Email (MIME): attachments are Base64-encoded so they can travel through text-only mail systems.
- Config and secrets in Kubernetes: values in a Secret are stored as Base64.
A note on security
Since decoding needs no key, treat Base64 data as if it were plain text. If you find an API key or password in Base64 in a codebase or a log, it is exposed and should be rotated.
Frequently asked questions
Is Base64 a form of encryption?
No. Base64 is an encoding, not encryption. Anyone can decode it instantly without a key, so never use it to hide passwords or secrets. Its job is to carry binary data safely through systems built for text.
Why is Base64 output longer than the input?
Base64 represents every 3 bytes of data with 4 characters, so encoded output is about 33% larger than the original, plus up to two "=" padding characters.
What is URL-safe Base64?
Standard Base64 uses "+" and "/", which have special meanings in URLs. The URL-safe variant, also called Base64URL, replaces them with "-" and "_" and usually drops the "=" padding. JSON Web Tokens use this variant.
Why does decoding show an error about UTF-8?
The Base64 string decoded correctly, but the bytes inside aren't readable text. They are probably an image, PDF or other binary file. Use a Base64-to-file tool to save binary data.