Base64 Encoder/Decoder

Base64 encodes binary data into ASCII characters. Widely used for email attachments, data URIs, and API tokens. The URL-safe option converts +/= characters to URL-friendly alternatives.

Text Input
Base64 Output

What is Base64 Encoder/Decoder?

Base64 is a binary-to-text encoding scheme that converts binary data into an ASCII string format using 64 printable characters (A-Z, a-z, 0-9, +, /). It is widely used in email attachments (SMTP/MIME), image data URIs for web development, JWT tokens, HTTP Basic Authentication, and anywhere binary data needs to travel through text-only channels. While the encoded output is roughly 33% larger than the original, Base64 guarantees lossless round-trip conversion and remains one of the most essential encoding tools for developers. The name "Base64" comes from the fact that the encoding uses exactly 64 characters. It was first standardized in 1987 as part of PEM (Privacy-Enhanced Mail) in RFC 989, and the most widely referenced specification today is RFC 4648, published in 2006, which defines both standard Base64 and its URL-safe variant. Compared to alternatives like percent-encoding (URL encoding) or hexadecimal encoding, Base64 strikes a good balance between encoding efficiency and readability.

How It Works

Base64 encoding processes input data in groups of 3 bytes (24 bits). The 24 bits are divided into four 6-bit groups, and each 6-bit value (0 through 63) is mapped to a character from a predefined 64-character lookup table. For example, the string "Hi" is two bytes in UTF-8: 0x48 0x69. In binary, that becomes 01001000 01101001. To fill a complete 3-byte group, a zero-padding byte is appended: 01001000 01101001 00000000. Splitting into 6-bit chunks gives 010010 000110 100100 000000, which maps to the characters S, G, k, and A respectively. Because the last byte was padding, the final character is replaced with "=", producing "SGk=". This 3-bytes-to-4-characters expansion is exactly why Base64 output is approximately 33% larger than the original data.

Using the Tool Step by Step

  1. Choose a direction with the Encode / Decode tabs at the top left. The input and output labels update to match the selected mode.
  2. Type or paste your content into the left panel. Because Live conversion is on by default, the result appears in the right panel immediately — no button press needed.
  3. Check URL-safe if the output will travel inside a URL, filename, or JWT. This swaps + for -, / for _, and drops the trailing = padding. The same box must be checked when decoding a URL-safe string.
  4. If you turned Live off, click the Encode (or Decode) button to run the conversion manually.
  5. The arrow swap button moves the output back into the input and flips the mode — convenient for round-trip checks: encode a string, swap, decode, and confirm you get the original back.
  6. Finish with Copy to grab the result or Clear to start over.

Practical Scenarios

Building a Basic Auth header for API testing. HTTP Basic Authentication is just username:password encoded as Base64. Encode admin:s3cret here, and you get YWRtaW46czNjcmV0, ready to drop into a request: curl -H "Authorization: Basic YWRtaW46czNjcmV0" https://api.example.com. The reverse is equally useful — decode a Basic header captured in a log to see which account made the call.

Embedding small assets as data URIs. A tiny SVG or PNG can live directly inside CSS: background-image: url("data:image/svg+xml;base64,PHN2ZyB4bWxucz0i..."). That eliminates an HTTP request at the cost of a 33% size increase, so reserve the technique for assets of a few kilobytes.

Inspecting configuration and secrets pipelines. Kubernetes stores Secret values Base64-encoded, and many CI systems expect multiline credentials (like service-account JSON) to be passed as a single Base64 string in an environment variable. Encoding here first lets you verify the exact value before pasting it into a manifest. And remember: this is transport encoding, not protection — anyone with the string can decode it.

FAQ

Does my input leave the browser?

No. Encoding and decoding run locally using the browser's native btoa() and atob() functions. Nothing is transmitted to any server, so credentials and tokens are safe to paste here.

Why do some outputs end with = or ==?

Base64 emits output in 4-character blocks representing 3 input bytes. When the input length is not a multiple of 3, the final block is padded: one leftover byte produces ==, two leftover bytes produce =. Padding carries no data — it only keeps the length aligned so decoders know where the content ends.

What exactly does URL-safe change?

Standard Base64 uses + and /, both of which have special meaning in URLs (+ can be read as a space in query strings, / as a path separator). The URL-safe alphabet from RFC 4648 substitutes - and _ and typically omits padding. JWTs use this variant, which is why a raw JWT segment sometimes fails in a standard decoder.

Is Base64 a form of encryption or compression?

Neither. It is a reversible representation change that anyone can undo without a key, and it makes data larger, not smaller. Use real encryption (e.g., AES) for confidentiality and a compression algorithm (e.g., gzip) for size reduction; Base64 is only for moving binary data through text-only channels.

How are emoji and non-Latin characters handled?

The tool converts your text to UTF-8 bytes before encoding, so emoji, Korean, Japanese, and any other Unicode text round-trip correctly. If another system decodes the same string into garbled text, it is almost certainly interpreting the bytes with a different character encoding rather than UTF-8.

Why does decoding fail with an error?

Common causes: stray whitespace or line breaks picked up while copying, a string whose length is not a multiple of 4, characters outside the Base64 alphabet, or a URL-safe string decoded without the URL-safe option enabled. Trimming the input and toggling URL-safe resolves the vast majority of failures.

Is there a limit on input size?

There is no hard-coded limit; practical capacity depends on your browser's memory since the whole string is processed at once. Text up to several megabytes converts fine, but for very large binary files a command-line tool such as base64 on Linux/macOS or certutil on Windows is the better fit.

Worth Exploring

Further Reading