🔤 Base64 Encode and Decode Online

What is the Base64 Encode Decode?

Base64 is a binary-to-text encoding that represents arbitrary data using only 64 printable ASCII characters: the uppercase letters A to Z, the lowercase letters a to z, the digits 0 to 9, and the two symbols + and /. It exists because many older systems and protocols were built to carry plain text reliably but corrupt or strip raw binary bytes. By re-expressing those bytes as safe text, Base64 lets you push images, keys, tokens, and other binary blobs through email bodies, JSON fields, URLs, HTML attributes, and config files without them breaking. The scheme is formally defined in RFC 4648, the same document that also describes Base16 (hex) and Base32.

The most important thing to understand is that Base64 is an encoding, not encryption. There is no key and no secret involved. Anyone who sees a Base64 string can decode it back to the original data in a fraction of a second, which is exactly what this tool does on the Decode tab. That means Base64 provides zero confidentiality. It is purely a transport and storage convenience, useful when binary data needs to live somewhere that only accepts text. If you actually need secrecy, you must layer real encryption (such as AES) underneath, and you can then Base64-encode the resulting ciphertext for safe transport.

The algorithm works by reading the input three bytes (24 bits) at a time and splitting those 24 bits into four groups of 6 bits. Each 6-bit group is a number from 0 to 63, which maps to exactly one character in the Base64 alphabet. Three input bytes therefore become four output characters, which is why Base64 output is always about 33% larger than the original (a 4-to-3 ratio). When the input length is not a clean multiple of three, the encoder pads the final group with one or two = characters so the total output length is always a multiple of four. Decoders use that padding, plus the known 4-to-3 ratio, to reconstruct the exact original byte count.

A detail that trips many people up is text encoding. Base64 operates on bytes, but human text is made of characters, and a single character like e-acute or an emoji can be several bytes in UTF-8. This tool first converts your text to UTF-8 bytes with the browser TextEncoder, then Base64-encodes those bytes, and reverses the process on decode with TextDecoder. That is why it can round-trip "cafe" with an accent or a rocket emoji correctly, whereas a naive JavaScript btoa call throws an error the moment it meets any character above code point 255. Choosing the right byte encoding before you encode is the single most common source of "it worked on my machine but broke in production" Base64 bugs.

There are two main flavors of the alphabet. Standard Base64 (the MIME and email default) uses + and / for values 62 and 63. URL-safe Base64, defined in the same RFC, swaps those for - and _ so the encoded value can sit inside a URL query string, a path segment, or a filename without needing percent-escaping, and it often drops the = padding too. JSON Web Tokens (JWTs), for example, use the URL-safe, unpadded variant for all three of their dot-separated sections. This tool produces standard output by default and switches to the URL-safe alphabet when you tick the option, and its decoder accepts either variant automatically so you never have to guess.

One more wrinkle shows up with email. The MIME standard wraps Base64 output into lines no longer than 76 characters, inserting a CRLF line break at each boundary, which is why a Base64-encoded attachment in raw email source looks like a tall block of fixed-width text. Most web APIs and data URIs use a single unbroken line instead. When you decode a string that contains newlines or stray whitespace, a tolerant decoder simply ignores those characters, and this tool does the same so pasted email or PEM-style blocks decode cleanly.

When to use it

• Embedding a small image, font, or SVG icon directly in CSS or HTML as a data URI (data:image/png;base64,...) to remove a separate network request.
• Building an HTTP Basic Authorization header, which expects the literal string "user:password" encoded as Base64 after the word Basic.
• Inspecting or debugging the payload of a JSON Web Token (JWT), whose header, payload, and signature are each Base64URL encoded.
• Safely storing binary or special characters inside a JSON field, an XML document, a YAML config, or a URL query string without breaking the format.
• Decoding configuration secrets, certificates, or keys that tools and cloud platforms hand you as Base64 blobs (for example PEM bodies or Kubernetes secret values).
• Pasting a suspicious or obfuscated Base64 string to quickly reveal the human-readable text hidden inside it.

How to use the Base64 Encode Decode

1. Choose Encode to turn text into Base64, or Decode to turn Base64 back into text.
2. Type or paste your content into the input box. The result updates as you type.
3. Optionally tick URL-safe output to swap + and / for - and _ and drop the = padding.
4. Press Copy to copy the result, or Swap input and output to feed the result back through.
5. When decoding, paste the full string including any = padding; newlines and spaces are ignored automatically.

Formula & method

Worked examples

The Base64 alphabet (index value to character)

Input length, padding, and how the output ends

Standard vs URL-safe Base64 at a glance

Common mistakes to avoid

• Treating Base64 as encryption. Base64 hides nothing. Anyone can decode it in seconds, so never use it to "protect" passwords, tokens, or private data. Use real encryption (such as AES) when you need secrecy, then Base64 the ciphertext if you must transport it as text.
• Breaking UTF-8 with raw btoa and atob. The browser btoa function throws on any character above code point 255, and atob returns mangled bytes for multibyte text. Always convert to UTF-8 bytes first, which this tool does for you, so emoji and accented text survive.
• Mixing up standard and URL-safe variants. URL-safe Base64 uses - and _ instead of + and / and often drops padding. Decoding a URL-safe string with a strict standard decoder fails. This tool accepts both automatically, so you do not have to convert by hand.
• Stripping or forgetting the = padding. Some decoders are strict and reject input whose length is not a multiple of four. If you copied a value without its trailing = characters, a strict decoder errors out. This tool tolerates missing padding, but other systems may not.
• Forgetting the output grows by about a third. Base64 inflates data by roughly 33% (4 characters per 3 bytes), and MIME line breaks add a little more. For large payloads this size bump matters for bandwidth, storage, and request limits, so do not assume the encoded form is free.
• Leaving whitespace or quotes in pasted input. A tolerant decoder ignores newlines and spaces, but surrounding quote marks, a "base64," data-URI prefix, or other stray characters are not valid Base64 and will corrupt the result. Strip the prefix and quotes before decoding.

Glossary

Base64

A binary-to-text encoding that represents arbitrary data using 64 printable ASCII characters, so it can travel safely through text-only channels.

Encoding

A reversible transformation of data into another format. Unlike encryption, it uses no key and provides no secrecy.

UTF-8

The dominant character encoding for text. It represents each character as one to four bytes, which Base64 then operates on.

Padding

The = characters added to the end of Base64 output so its length is always a multiple of four, signalling how many real bytes the final block holds.

URL-safe Base64

A Base64 variant that replaces + and / with - and _ so the result can sit in a URL or filename without escaping. JWTs use this variant.

Data URI

A scheme that embeds file contents (often Base64 encoded) directly inside a URL, such as data:image/png;base64,iVBOR...

RFC 4648

The IETF standard that formally defines Base16, Base32, and Base64, including both the standard and URL-safe alphabets.

JWT

A JSON Web Token, a compact credential whose header, payload, and signature are each Base64URL encoded and joined with dots.

Frequently asked questions