Base64 Encoder and Decoder

What base64 is for

Base64 represents binary data using only 64 printable characters — A–Z, a–z, 0–9, plus and slash. It exists because many systems were built to carry text and will mangle or reject raw bytes.

Every three bytes become four characters, so the result is about 33 % larger than the input. That is the cost of making binary safe to send through something that expects text.

Base64 is not encryption

This matters and people get it wrong. Base64 is an encoding, not a cipher. There is no key and no secret. Anyone can decode it instantly — this page will do it for you.

Putting a password in base64 provides no security whatsoever. It only obscures it from a casual glance, which is worth roughly nothing and is worse than nothing if it makes someone feel safe. For actual secrecy you need encryption; for integrity checking you want a hash.

URL-safe base64

Standard base64 uses + and /, both of which mean something else in a URL, and pads with =. The URL-safe variant swaps them for - and _ and drops the padding.

This is what JSON Web Tokens use, which is why a JWT is three URL-safe base64 chunks separated by dots. Decoding the first two is how you read a token's contents — and a reminder that a JWT payload is readable by anyone holding it.

The Unicode trap

The browser's built-in encoder only handles characters below 256, so naive implementations throw an error on any accented letter or emoji. This page converts text to UTF-8 bytes first, which handles every script and every emoji correctly.

If a base64 string from elsewhere decodes into mojibake, the tool that produced it probably skipped that step.

Common uses

• Embedding a small image in HTML or CSS — the image to base64 tool does this directly.
• Reading a JWT payload during debugging.
• Basic authentication headers, which are base64 of user:password — and therefore not secret.
• Email attachments, which have used base64 since MIME.

Questions people ask

Is base64 encryption?

No. It is an encoding with no key and no secret. Anyone can decode it instantly, so it provides no security at all.

Why is my base64 longer than the original?

Every three bytes become four characters, so it is about 33 % larger. That is the cost of making binary safe to send as text.

What is URL-safe base64?

A variant that swaps + and / for - and _ and drops the padding, because those characters mean something else in a URL. JSON Web Tokens use it.

Why do some tools fail on emoji?

Because the browser's built-in encoder only handles characters below 256. Text has to be converted to UTF-8 bytes first, which this page does.

Can I decode a JWT here?

You can decode its parts. Split it on the dots and decode the first two, which are URL-safe base64. The signature is not readable text.

Your text stays in the page

This matters more here than on most tools. People paste API keys into hash generators, customer data into CSV converters, contract wording into diff checkers and configuration into JSON validators. Almost every site offering these sends your input to a server to process it.

Nothing here is transmitted. The work happens in your browser, this site is static files with no server behind it, and the about page lists every request the site makes, read live from your own browser so you can check rather than trust.