Base64 Encode & Decode

How to use the Base64 encoder and decoder

1. Choose Encode to turn text into Base64, or Decode to turn Base64 back into text.
2. Paste your input. Text is treated as UTF-8, so accented letters, non-Latin scripts and emoji work correctly.
3. Enable the URL-safe option if the result goes into a URL, a filename or a JWT.
4. Copy the output.

Encoding and decoding happen locally in your browser; nothing you paste is uploaded or stored.

How Base64 works

Base64, defined in RFC 4648, represents arbitrary binary data using 64 printable ASCII characters: A–Z, a–z, 0–9, + and /. It exists so that binary content can travel safely through systems designed for text, such as email, JSON, XML and HTTP headers.

The algorithm takes the input 3 bytes (24 bits) at a time and splits them into four 6-bit groups. Each 6-bit value (0–63) selects one character from the alphabet. The word Man shows the process:

Because every 3 bytes become 4 characters, Base64 output is about 33% larger than the input (plus line breaks, if a format such as MIME inserts them).

Padding with =

When the input length is not a multiple of three, the last group is padded. One leftover byte produces two characters plus ==; two leftover bytes produce three characters plus =. For example, Hi encodes to SGk=.

URL-safe Base64

The standard + and / characters have special meaning in URLs and file paths. RFC 4648 §5 defines the base64url alphabet, which replaces them with - and _. Padding is often omitted. JSON Web Tokens use base64url without padding.

Standard:  +/8=
URL-safe:  -_8

Common pitfalls

Base64 is not encryption

Anyone can decode Base64 instantly; there is no key. Never use it to "hide" passwords or API keys. For integrity checks use a hash from the hash generator, and for confidentiality use real encryption.

UTF-8 in JavaScript

The browser's built-in btoa() only accepts characters in the Latin-1 range and throws an error for anything else. Convert the text to UTF-8 bytes first:

btoa("✓");   // InvalidCharacterError

const bytes = new TextEncoder().encode("✓");
btoa(String.fromCharCode(...bytes));   // "4pyT"

Mixing alphabets

Decoding base64url data with a strict standard decoder fails on - and _, or on missing padding. Convert the alphabet and re-add padding to a multiple of four characters before decoding.

Where you will meet Base64

• Data URIs embed small files directly in HTML or CSS: data:image/png;base64,iVBORw0KGgo...
• HTTP Basic authentication sends username:password encoded in Base64. user:pass becomes Authorization: Basic dXNlcjpwYXNz, which is trivially reversible, so Basic auth must only be used over HTTPS. You can inspect such headers with the HTTP headers checker.
• Email attachments (MIME) and PEM certificates and keys.
• JWTs, whose header and payload are base64url-encoded JSON. Use the JWT decoder to read them.

Frequently asked questions

Why does my Base64 string end with = or ==?

That is padding. It tells the decoder how many bytes the final group contained when the input length was not divisible by three.

Is Base64 secure?

No. It is an encoding, not encryption. It provides no confidentiality at all; it only makes binary data safe to transport as text.

Why is the encoded output bigger than the input?

Each Base64 character carries 6 bits instead of 8, so 3 input bytes need 4 output characters, an overhead of roughly one third.

What is the difference between Base64 and base64url?

Only two characters differ: base64url uses - and _ instead of + and /, and usually drops the = padding, so the result can be placed in URLs without further escaping.