Base64 Encoder and Decoder
Encode text to Base64 or decode a Base64 string (URL-safe too), with correct UTF-8 handling, right in your browser.
Enter some text to see the result.
What Base64 is and how this tool works
Base64 is a way to represent binary data using only 64 printable characters: upper and lower case letters, digits, "+" and "/", plus "=" used as padding. It's needed whenever bytes have to travel through a channel built for text: email attachments (MIME), images embedded in a page as data URLs, the credentials in an Authorization: Basic header, binary fields inside JSON. This tool encodes text to Base64 and decodes Base64 strings back to text, entirely in your browser.
How it works is simple. The data is read in groups of 3 bytes (24 bits), split into four 6-bit blocks; each block is a number from 0 to 63 that maps to one character of the alphabet. That's why the output is about a third longer than the input. When the bytes aren't a multiple of 3, "=" padding is added: "Man" becomes "TWFu", "Ma" becomes "TWE=" and "M" becomes "TQ==".
There's a variant called Base64URL that replaces "+" and "/" with "-" and "_" and often drops the padding, because those characters have special meaning in URLs. It's the format used by JWT tokens and many identifiers in web parameters. The tool can produce both variants and, when decoding, detects which alphabet you're using on its own; it also accepts strings without padding, with line breaks (as in email messages) or with a "data:…;base64," prefix.
One detail that trips up many online tools is non-ASCII text. Base64 works on bytes, not characters: before encoding, a letter like "è" becomes two UTF-8 bytes and an emoji becomes four. The browser's btoa function, for instance, throws on any character outside Latin-1. Here the UTF-8 conversion is done correctly in both directions. And if you decode data that isn't valid UTF-8 text, like an image or a compressed file, the tool doesn't print nonsense symbols: it tells you so and shows the bytes in hexadecimal.
Base64 is not encryption. It's an encoding anyone can reverse, with no keys or secrets: hiding a password in Base64 protects nothing. HTTP Basic authentication credentials, for example, are only Base64, which is why they must always travel over HTTPS. If you need confidentiality, use real encryption. And if you're inspecting a JWT, its first two parts are Base64URL-encoded JSON: this site's JWT Decoder decodes them and shows them already formatted.
Frequently asked questions
- Is Base64 a form of encryption?
- No. It's an encoding, not encryption: anyone can turn it back into the original text with no keys. It protects nothing, so don't use it to hide passwords or confidential data.
- Why does a Base64 string often end with "="?
- Because data is encoded in groups of 3 bytes. If 1 or 2 are left over, one or two "=" are added to complete the last group of 4 characters. The Base64URL variant often leaves them out, and this tool accepts both forms.
- What's the difference between Base64 and Base64URL?
- Base64URL uses "-" and "_" instead of "+" and "/", which have special meaning in URLs, and usually has no "=" padding. It's the format of JWT tokens. The tool detects which alphabet you're decoding on its own.
- Why is the output longer than the input?
- Every 3 bytes become 4 characters, so the Base64 string is about a third longer (plus any padding). The tool shows the exact count below the result.
- How do accents and emoji work?
- Text is first converted to UTF-8 bytes and then encoded, so "è", "€" and emoji encode and decode correctly. Many tools built on btoa fail on those characters.
- Is the data I enter sent to a server?
- No. Encoding and decoding happen entirely in your browser: no text is transmitted, stored or logged.
From the books
