Base64 Encoder & Decoder

Encode text to Base64 or decode Base64 back to plain text. Supports standard and URL-safe Base64. All processing is done in your browser.

Input Text

Frequently Asked Questions

Base64 is a binary-to-text encoding scheme that represents binary data using 64 printable ASCII characters (A–Z, a–z, 0–9, +, /). It is used to safely transmit binary data over text-based channels like email (MIME), JSON, HTML data URIs, and HTTP headers.
Base64 encodes 3 bytes at a time into 4 characters. If the input length is not a multiple of 3, padding characters (= or ==) are appended to make the output length a multiple of 4. URL-safe Base64 often omits padding since the length can be inferred.
Standard Base64 uses + and / which have special meanings in URLs and must be percent-encoded. URL-safe Base64 (RFC 4648 §5) replaces + with - and / with _, and omits padding, making it safe for use in URLs, filenames, and JWT tokens without extra encoding.
No. Base64 is an encoding scheme, not encryption. Anyone who sees a Base64 string can instantly decode it. Never use Base64 alone to "protect" sensitive data. Use encryption (AES, RSA) for that purpose. Base64 is only for encoding binary data into a text-safe format.
Base64 output is approximately 33% larger than the input — every 3 bytes of input become 4 Base64 characters. This overhead makes it unsuitable for large binary transfers where bandwidth is a concern, but acceptable for small payloads like tokens or embedded images.
Base64 is used in: email attachments (MIME encoding), embedding images in HTML/CSS as data URIs (data:image/png;base64,…), JSON Web Tokens (JWT header and payload), Basic HTTP authentication (Authorization: Basic base64(user:pass)), and storing binary data in text-only databases or configuration files.
On Linux/macOS: base64 filename.png. On Windows PowerShell: [Convert]::ToBase64String([IO.File]::ReadAllBytes('file.png')). In Node.js: Buffer.from(data).toString('base64'). In PHP: base64_encode(file_get_contents('file.png')). This tool handles text — for binary files use a CLI or server-side tool.
If the original data was binary (an image, PDF, zip file), decoding produces raw binary bytes that cannot be displayed as readable text. Garbled output usually means the Base64 was generated from binary content, not text. For binary files, you need to save the decoded bytes directly as a file rather than displaying them as text.
Standard Base64 uses A–Z, a–z, 0–9, +, /, and = for padding. URL-safe Base64 uses A–Z, a–z, 0–9, -, _, with optional padding. Any other characters in a Base64 string indicate corruption or that the string is not valid Base64.
This tool uses UTF-8 encoding before Base64 conversion. The input text is first encoded as UTF-8 bytes, then those bytes are Base64-encoded. On decode, the Base64 bytes are decoded and then interpreted as UTF-8 text. This correctly handles all Unicode characters including emoji, Chinese, Arabic, and other multibyte scripts.

About This Base64 Encoder / Decoder

This free Base64 encoder and decoder converts text to and from Base64 format entirely in your browser. No data is sent to a server. Supports standard Base64 (RFC 4648 §4) and URL-safe Base64 (RFC 4648 §5).

When to use this tool

  • Encoding strings for use in JWT tokens or Basic auth headers
  • Decoding a Base64 payload from an API response or JWT
  • Converting data URIs for embedded images in HTML/CSS
  • Debugging Base64-encoded strings in logs or config files

Related Developer Tools

URL Encoder HTML Entities JWT Decoder Hash Generator

Related Articles

In-depth guides and technical articles.

View all →
eyJ, iVBOR, JVBER: Identifying Base64 Before You Decode It
Developer Sep 21, 2026
eyJ, iVBOR, JVBER: Identifying Base64 Before You Decode It
iVBOR is a PNG, JVBER is a PDF, eyJ is JSON. Base64 prefixes identify content before decoding — plus what "invalid character" and "incorrect padding" actually mean.
Base32, Base58, Base85: When Base64 Is the Wrong Encoding
Developer Aug 21, 2026
Base32, Base58, Base85: When Base64 Is the Wrong Encoding
Base64 isn't the only binary-to-text encoding, and it isn't always the best one. Here's what Base32, Base58, Base85 and Base62 solve that Base64 doesn't.
JWT Uses Base64url but Basic Auth Uses Standard Base64 — Why the Encoding Choice Matters in Security Contexts
Developer Jun 30, 2026
JWT Uses Base64url but Basic Auth Uses Standard Base64 — Why the Encoding Choice Matters in Security Contexts
JWTs use Base64url (not standard Base64) because they appear in URLs and HTTP headers where + and / would break things. HTTP Basic Auth uses standard Base64 (not Base64url) because it's an opaque header value. Here's the three security contexts for Base64 encoding (JWT, Basic Auth, CSP nonces/hashes), why JWT payloads are encoded not encrypted (anyone with the token can read the claims), and how to detect standard Base64 vs Base64url from the encoded string.
Base64 Makes Data 33% Larger — Here's the Exact Math and When That Overhead Actually Matters
Developer Jun 23, 2026
Base64 Makes Data 33% Larger — Here's the Exact Math and When That Overhead Actually Matters
Base64 makes data 33% larger — exactly, not approximately, because encoding 6 bits per character while binary uses 8 bits per byte produces a 4/3 size ratio as a direct mathematical consequence. Here's why that overhead is negligible for tokens and small images but significant for large file APIs, the common JSON-Base64-embedded-file pattern and its alternatives, and what validation steps most Base64 decoding code skips for untrusted input.
Base64 vs Base64url: Why `+`, `/`, and `=` Break URLs, and Why JWTs Use a Different Alphabet
Developer Jun 13, 2026
Base64 vs Base64url: Why `+`, `/`, and `=` Break URLs, and Why JWTs Use a Different Alphabet
Standard Base64's `+`, `/`, and `=` characters all have special meaning in URLs — which is why a Base64-encoded JWT pasted directly into a URL can silently corrupt, and why Base64url exists as a separate, URL-safe alphabet. Here's exactly which characters differ, why JWTs require Base64url specifically, how padding works and why Base64url commonly omits it, and how to tell the two variants apart.