Base64 encoder and decoder

Encode text to Base64 or decode it back. Unicode is handled properly, the URL-safe alphabet is one tick away, and data URIs are recognised automatically.

URL-safe alphabet Wrap at 76 characters

Input 0 lines

Encode

Base64 0 lines

Paste text on the left and press Encode, or switch to Decode.

What Base64 is for

Base64 turns arbitrary bytes into 64 printable characters, so binary data can travel through channels that only handle text. It is an encoding, not encryption — anyone can decode it, and this page is proof of that.

Three characters per four output characters: encoding always makes data about 33 percent larger. That is the cost of the guarantee that nothing in the output will be mistaken for a control character or a delimiter.

Where you meet it

Data URIs

data:image/svg+xml;base64,... embeds an image directly in CSS or HTML, trading file size for one fewer request. Paste a whole data URI into the decoder — the prefix is handled.

Email attachments

MIME has encoded attachments this way since 1992. It is why the 76-character wrap option exists — that is the line length email requires.

Basic authentication

Authorization: Basic dXNlcjpwYXNz is just user:pass encoded. Anyone watching the connection can read it, which is why Basic auth needs HTTPS.

JSON Web Tokens

A JWT is three Base64url segments joined by dots. Decode the first two and you can read the header and payload — they are not secret. Only the signature stops them being altered.

API keys and secrets

Kubernetes secrets, certificates and private keys are frequently stored Base64-encoded. Encoded, not protected.

Binary in JSON

JSON has no binary type, so file contents inside a JSON payload are Base64. This is why uploading an image as JSON costs a third more bandwidth than a multipart form.

Standard or URL-safe

Standard Base64 uses + and / as its last two characters and pads with =. All three mean something in a URL: + decodes to a space in a query string, / is a path separator, and = separates a parameter from its value.

The URL-safe variant (RFC 4648 §5) swaps them for - and _ and drops the padding. It is what JWTs use, and what you want for anything that goes in a URL or a filename.

The decoder accepts either alphabet and restores missing padding automatically, so you do not need to know which variant you were handed.

Unicode works correctly here

JavaScript's built-in btoa throws on any character above U+00FF, which is why so many Base64 tools mangle accented characters, emoji and non-Latin scripts. This one encodes to UTF-8 bytes first, so café, 日本語 and 🎨 all round-trip exactly.

Round trip

café 日本語 🎨
  ->  Y2Fmw6kg5pel5pys6KqeIPCfjqg=
  ->  café 日本語 🎨

It is not security

Base64 is reversible by design and requires no key. Encoding a password, an API token or personal data hides it from a casual glance and from nobody else.

If you need something to stay secret in transit, use TLS. If it needs to stay secret at rest, use real encryption. If you need to verify a value without storing it, use a password hash such as Argon2 or bcrypt. Base64 is for none of these things — it is for getting bytes safely through a text channel.

Doing it in code

JavaScript — Unicode-safe

const enc = btoa(String.fromCharCode(...new TextEncoder().encode(text)));
const dec = new TextDecoder().decode(
  Uint8Array.from(atob(enc), c => c.charCodeAt(0))
);

Python

import base64
base64.b64encode(text.encode("utf-8")).decode("ascii")
base64.b64decode(encoded).decode("utf-8")
base64.urlsafe_b64encode(data)   # - and _ instead of + and /

Command line

base64 file.png > file.b64
base64 -d file.b64 > file.png

Questions about this tool

Is my data sent anywhere?

No. Encoding and decoding happen in your browser. That matters here more than on most pages, because Base64 so often contains credentials, tokens and private keys.

Why does my decoded text come out as gibberish?

Usually because the input was binary rather than text — an encoded image or PDF has no readable form. Occasionally it is an encoding mismatch: the data was encoded from a legacy character set rather than UTF-8. This decoder assumes UTF-8, which is correct for almost everything written this century.

Can I encode a file?

Use Open file to load a text file. Binary files such as images are not supported here — the input panel is a text field. For an image data URI, the command line (base64 file.png) is the tool for the job.

What are the equals signs at the end?

Padding. Base64 works in groups of three input bytes, and = marks a final group that was short. You will see none, one or two. The URL-safe variant drops them, and the decoder here adds them back when they are missing.

Is Base64 the same as encryption?

No. There is no key and it is trivially reversible — this page reverses it. Encoding solves transport, encryption solves secrecy, and they are unrelated problems.

Learn the why, not just the how

Longer reading on formatting, indentation and minification.