Base64 Encoder & Decoder

Base64 turns arbitrary bytes into 64 printable characters so they survive systems that only expect text - HTTP headers, email bodies, JSON string fields, YAML config, environment variables. This encoder converts in both directions and handles Unicode correctly, which is where most quick browser one-liners fall over.

Free · runs in your browser · updated

Input Plain Text
Output Text
Advertisement

Base64 Encoder & Decoder at a glance

What it does
Encode text to Base64 or decode it back, with correct UTF-8 handling for accents and emoji.
Where it runs
Entirely in your browser — no data is uploaded
Works offline
Yes, once the page has loaded
Cost
Free, with no account and no usage limit
Category
Developer & Code

How to use the Base64 encoder

  1. Paste your text - plain text, JSON, a key, a certificate body.
  2. Press Encode to produce Base64, or Decode to turn Base64 back into readable text.
  3. Copy the output. If decoding produced mojibake, the source was probably binary data rather than text - see below.

How the encoding actually works

Base64 reads the input three bytes at a time. Three bytes is 24 bits, which splits evenly into four 6-bit groups, and each group indexes an alphabet of A-Z a-z 0-9 + /. So every three bytes in become four characters out, and the encoded form is always about 33% larger than the original.

When the input length is not a multiple of three, the final group is padded with = signs - one = if two bytes remained, two if one byte remained. That is why so much Base64 ends in = or ==, and why a string of length not divisible by four is usually truncated.

Text:    M         a         n
Bytes:   77        97        110
Bits:    010011 010110 000101 101110
Base64:  T      W      F      u

Unicode, and why some encoders break

The browser's built-in btoa() throws an error on any character above U+00FF, so pasting an emoji or a Cyrillic name into a naive tool fails outright. The correct approach is to encode the string to UTF-8 bytes first and Base64 those bytes. This tool does that, so café, 日本語 and 🎉 all round-trip intact.

If you decode something and get question marks or é where an accent should be, the encoder that produced it did not do the UTF-8 step.

Advertisement

Standard vs URL-safe Base64

Standard Base64 uses + and /, both of which have meaning inside a URL - + decodes to a space in a query string and / is a path separator. URL-safe Base64 (RFC 4648 §5) swaps them for - and _ and usually drops the padding.

You will see the URL-safe variant in JSON Web Tokens, OAuth state parameters and anything passed through a path segment. If a decoder rejects a token, check for - and _ and translate them back before decoding.

Base64 is not encryption. It is a reversible transport encoding with no key and no secret. Anyone can decode it in a second. Never use it to hide a password, and never treat a Base64 blob in a config file as protected.

Where you will need it

  • HTTP Basic authentication - the header value is Base64(username:password).
  • JWTs - each of the three segments is URL-safe Base64. The JWT decoder splits them for you.
  • Data URIs - embedding a small image directly in CSS or HTML. The image to Base64 converter handles files.
  • Kubernetes secrets - values in a Secret manifest are Base64, which is encoding and not protection.
  • Email attachments - MIME has used Base64 since the early 1990s to move binaries over a 7-bit transport.
  • PEM certificates - the body between the BEGIN and END lines is Base64-encoded DER.

Frequently asked questions

No, and it is not meant to be. It is an encoding, not a cipher - there is no key, and decoding is trivial. Use it to move bytes safely through text channels, never to conceal them.

Most likely the original data was binary - an image, a zip, a compiled file - rather than text. Base64 will decode it correctly, but rendering those bytes as characters produces noise. It can also mean the string was truncated or is the URL-safe variant.

Padding. It brings the final group up to four characters and tells the decoder how many bytes of the last group are real. One = means the last group carries two bytes, two = means one byte.

Yes. The input is converted to UTF-8 bytes before encoding, so emoji, Arabic, Chinese and accented Latin all survive the round trip unchanged.

No. Encoding and decoding happen in JavaScript in your browser. This matters because Base64 strings are so often credentials - Basic auth headers, Kubernetes secrets, API keys.

Nothing you enter here leaves your browser

Base64 Encoder & Decoder does its work in JavaScript running on your own device. The page loads once, and after that there is no upload step and no server involved — which matters here because API responses, tokens and configuration files are exactly the kind of thing that should not be posted to someone else’s server for formatting.

You can verify this rather than taking our word for it: load the page, disconnect from the internet, and the tool keeps working. Our privacy policy sets out what is and is not collected, and this guide explains why the distinction matters.

Sponsored