Base64 Encoder & Decoder

How to use the Base64 converter

1. Choose a direction — encode text to Base64, or decode Base64 back to text.
2. Pick an alphabet when encoding. Standard for general use; URL-safe if the result goes into a URL or you are working with tokens.
3. Paste your input. Conversion happens as you type.
4. Copy the result, or use the swap button to feed it straight back through in the other direction.

Nothing is uploaded. All conversion happens in your browser.

When you would need this

Inspecting a JSON Web Token. JWT payloads are Base64URL encoded. Decoding one shows the claims, the expiry, and who issued it.

Reading a data URI. An embedded image or font in CSS or HTML is Base64. Decoding tells you what it actually is.

Building a Basic Auth header. The format is Authorization: Basic followed by username:password encoded as Base64.

Embedding a small asset. Inlining a tiny icon as a data URI removes an HTTP request, at the cost of about a third more bytes.

Moving data through a text-only channel. Email, older APIs and some configuration formats cannot carry raw binary. Base64 makes it survivable.

Why so many Base64 tools break on non-English text

This is worth explaining, because it is the single most common failure in online Base64 converters and it is entirely avoidable.

Browsers provide a built-in function called btoa(), and reaching for it is the obvious way to build one of these tools. The problem is what btoa actually expects: a string in which every character is a single byte — the Latin-1 range, U+0000 to U+00FF. Anything above that throws an InvalidCharacterError.

So btoa("hello") works. btoa("héllo") throws. btoa("日本語") throws. btoa("🎉") throws.

That is a large fraction of the world's text, and it fails at the first character outside a narrow Western European range. Tools built naively on btoa respond in one of three ways: they crash visibly, they catch the error and silently return nothing, or — worst — they pre-mangle the input with something like unescape(encodeURIComponent(...)) and produce output that decodes back to something different from what you put in.

The correct approach converts the text to UTF-8 bytes first, using TextEncoder, and encodes those bytes. UTF-8 represents every character as one to four bytes, all within the range btoa can handle. That is what this tool does, which is why héllo, 日本語, Ω≈ç√∫ and emoji all round-trip exactly.

You can verify it: encode something with an accent, decode it back, and confirm you get the original.

Base64 is not security

Worth its own section, because treating it as such causes real incidents.

Base64 has no key. It has no secret. It is a public, standardised, entirely reversible mapping between bytes and 64 printable characters. Decoding requires nothing but the willingness to decode.

Despite that, Base64-encoded values turn up regularly in places that clearly assumed otherwise: credentials in configuration files, API keys in client-side JavaScript, "obfuscated" values in URLs. Automated scanners look for Base64 strings precisely because they so often contain something interesting.

If a value needs to stay secret, it needs encryption with a key you control — and even then, the key has to live somewhere the attacker cannot reach. Base64 is transport, not protection.

The same applies to Basic Auth. Authorization: Basic dXNlcjpwYXNz is user:pass in plain view. It is only safe because HTTPS encrypts the connection carrying it, not because of the encoding.

Where the 64 characters come from

The name is literal: the encoding uses 64 characters, chosen because 64 is a power of two and every one of them survives systems that mangle anything unusual.

The standard alphabet is A–Z, a–z, 0–9, + and / — that is 26 + 26 + 10 + 2 = 64. Six bits of information fit exactly into one character, since 2⁶ = 64. Three bytes is 24 bits, which divides cleanly into four six-bit groups, which is why the encoding works in blocks of three input bytes to four output characters.

When the input is not a multiple of three, the final block is padded and = marks how much was added. One = means the last block held two bytes; two means it held one. The padding is not data — it exists so a decoder knows where the real content stopped.

The URL-safe variant swaps + for - and / for _, because the originals have meaning inside a URL: + can be read as a space in a query string, and / is a path separator. It also drops the padding, since = is reserved too. Everything else is identical, which is why a decoder can accept both without being told which it is looking at.

Limits and requirements

Decoding produces text. If the decoded bytes are not valid UTF-8 — a PNG, a PDF, any binary format — the tool says so rather than returning replacement characters. Use the image to Base64 tool for images.

Whole JWTs will not decode. The dots separating a token's three segments are not part of the Base64 alphabet. Decode one segment at a time. The signature segment is binary and will report as such.

Output is about 33% larger than input. Inherent to representing 256 byte values with 64 characters.

Very large inputs use memory. Both the input string and the encoded result are held at once. Multi-megabyte text will work but consume several times its own size while converting.

Browser support. Any modern browser on desktop or mobile.

Privacy: how this tool handles your text

Encoding and decoding run in your browser, on your device. Nothing is transmitted, logged or stored, and closing the tab discards everything.

This matters because of what Base64 is typically used for. Decoding a JWT means pasting a token that is very often still valid — anyone holding it can act as that user until it expires. Encoding a Basic Auth header means pasting a username and password in plain text. Decoding a data URI from a config file may reveal an embedded certificate or key.

A server-side converter receives all of that, and request bodies routinely end up in access logs, error trackers and backups without anyone intending it.

You can check this instead of trusting it. Open your browser's developer tools, switch to the Network tab, and convert something — nothing carries your input. Or disconnect from the internet after the page loads; it keeps working, because there is nowhere else for the work to happen.