Base64 encode & decode

What Base64 is for

Base64 encodes binary or text data using only 64 safe ASCII characters, which is how things like images, email attachments and data URIs travel through systems that only handle plain text. It isn't encryption — anyone can decode it — so it's about safe transport, not secrecy. This tool handles full UTF-8, so accented characters and emoji round-trip correctly, and everything happens locally in your browser.

When you'll reach for it

Base64 shows up whenever binary data has to ride through a text-only channel: inline images as data: URIs in CSS or HTML, small file payloads in JSON APIs, email attachments (MIME), and credentials in HTTP Basic Auth headers. Decoding is just as common — reading a JWT segment, inspecting a data URI someone sent you, or checking what an encoded config value actually contains.

Encoding is not encryption

Worth repeating: Base64 is reversible by anyone, so it hides nothing. It makes data safe to transport, not secret — never use it to protect passwords or sensitive values, where you want real encryption or hashing instead. Everything here runs in your browser, so whatever you paste stays on your device.

How the encoding actually works

Base64 takes three bytes at a time — 24 bits — and re-slices them into four 6-bit groups, each of which indexes a 64-character alphabet of A–Z, a–z, 0–9, + and /. Three bytes in, four characters out, which is why encoded data is always about 33% larger than the original.

When the input length is not a multiple of three, the last group is padded with = so the output still divides into fours. You can read the input length straight off the padding: Man encodes to TWFu with no padding, Ma becomes TWE=, and a single M becomes TQ==.

base64url, and why the variant matters

The standard alphabet's + and / are awkward in URLs and filenames, so RFC 4648 defines a URL-safe variant that substitutes - and _ in their place. The same two bytes encode as +/8= in standard Base64 and -_8= in base64url. Padding is also frequently stripped in the URL-safe form.

This trips people up constantly when decoding JWTs, which use base64url: paste a segment into a strict standard decoder and it may reject it or return the wrong bytes. If a decode looks like garbage, check which variant you are dealing with before assuming the data is corrupt.

Encoding is not encryption

This is worth stating plainly because it causes real security incidents. Base64 is a reversible, keyless transformation — anyone who has the string has the data. It hides nothing. Credentials in an HTTP Basic Auth header are Base64-encoded purely so they survive the transport encoding, which is exactly why Basic Auth is only safe over HTTPS.

If you need secrecy you need encryption; if you need to verify that data has not been altered you need a signature or a MAC. Base64 provides neither. For hashing, the hash generator covers the common algorithms, and for encoding text destined for a query string the URL encoder is usually what you actually want.