Base64 Encoder & Decoder

Base64 is a binary-to-text encoding scheme that represents arbitrary binary data using only 64 printable ASCII characters (A–Z, a–z, 0–9, plus “+” and “/”). It lets you safely move binary content — images, files, cryptographic keys — through channels that were designed for text, such as JSON, XML, email and URLs.

No. Base64 is encoding, not encryption. It provides zero confidentiality — anyone can decode a Base64 string instantly with no key. Never use Base64 to “hide” passwords, tokens or secrets. Use it only to transport binary data as text, and use real cryptography (AES, RSA, TLS) when you need security.

Open the Encode tab, type or paste your text, and the Base64 output appears instantly. The tool encodes via UTF-8, so emoji, accented letters and non-Latin scripts all encode correctly. You can switch between Standard, URL-safe and MIME variants and copy or download the result with one click.

Open the Decode tab and paste your Base64. The tool normalizes whitespace, accepts both standard and URL-safe alphabets, repairs missing padding and shows the decoded text. If the data is JSON it can pretty-print it, and if it is binary it offers to reconstruct the original file.

URL-safe Base64 swaps the two characters that have special meaning in URLs — “+” becomes “-” and “/” becomes “_” — and usually drops the “=” padding. This lets the encoded value travel inside query strings, path segments and JWTs without being corrupted by percent-encoding. The tool converts between standard and URL-safe automatically.

Base64 represents every 3 bytes of input using 4 ASCII characters, so the encoded output is roughly 33% larger than the original (plus a little padding). That overhead is the price of turning binary into safe text. For large assets, gzip/Brotli compression on the wire usually recovers most of the difference.

About 33–37%. The core ratio is 4 output characters for every 3 input bytes (a 4/3 ≈ 1.333× expansion), and MIME line breaks plus padding add a little more. The tool’s Analyzer shows the exact overhead percentage for your input.

Yes. In the File tab, upload or drag-and-drop a JPG, PNG, SVG, WebP, GIF or ICO and the tool encodes it instantly, shows a live preview, and generates a ready-to-paste Data URI for CSS or HTML. Everything happens in your browser — the image is never uploaded.

Paste the Base64 (or a full data: URI) into the Decode or File tab. The tool inspects the magic-number signature to detect the file type, previews images, and gives you a Download button that reconstructs the exact original bytes with the correct extension.

A Data URI embeds a file directly inside a string using the form data:[mime];base64,[payload]. It lets you inline small images, fonts or SVGs straight into CSS or HTML so the browser does not need a separate network request. The Data URI tab builds these for you, complete with copy-ready CSS and <img> snippets.

Yes. The JWT tab splits a token into its three base64url segments and decodes the header and payload into readable JSON, lists every claim, and flags expiry using the exp/iat/nbf fields. It decodes only — it never verifies the signature and never sees your secret key, so it is safe to inspect tokens locally.

Pasting is safe in the sense that nothing is transmitted — all decoding runs in your browser and no data is uploaded or logged. That said, treat live production tokens with care on any shared machine. The tool only decodes; it cannot authenticate, forge or validate a token, because that requires the signing secret.

Yes. Text is first encoded to UTF-8 bytes and then to Base64, so any Unicode character — emoji, CJK, Arabic, accented Latin — round-trips perfectly. The older btoa() approach breaks on these; this tool uses TextEncoder/TextDecoder to handle the full Unicode range.

Standard Base64 uses A–Z, a–z, 0–9, “+” and “/”, with “=” as padding (RFC 4648). The URL-safe alphabet replaces “+” with “-” and “/” with “_”. Together those 64 symbols (hence the name) map to the 6-bit groups the encoder produces from your bytes.

The “=” characters pad the output so its length is a multiple of 4. Because Base64 works in groups of 3 input bytes → 4 characters, an input whose length is not divisible by 3 leaves one or two “=” at the end. Padding is required by strict standard Base64 but is often omitted in URL-safe contexts.

The usual causes are: characters outside the alphabet (spaces in the middle, smart quotes, line numbers), wrong or missing padding, a length that is not a multiple of 4 for padded strings, or mixing the standard and URL-safe alphabets. The Validator pinpoints each problem and suggests a fix.

MIME Base64 (RFC 2045) is the variant used in email. It is standard Base64 with the output wrapped into lines of 76 characters separated by CRLF. The tool can produce MIME-wrapped output and also strips those line breaks automatically when decoding.

It groups the input into 24-bit blocks (3 bytes), then splits each block into four 6-bit numbers. Each 6-bit value (0–63) indexes into the 64-character alphabet to produce one output character. If the final block is short, the encoder pads with zero bits and appends “=” so decoders know how many bytes to drop.

Both turn binary into text, but hex uses 16 symbols (0–9, a–f) and needs 2 characters per byte (100% overhead), while Base64 uses 64 symbols and needs only ~1.33 characters per byte (33% overhead). Hex is easier to read byte-by-byte; Base64 is more compact. The Convert tab translates between them instantly.

Use it whenever you must embed binary inside a text-only field: a file upload inside a JSON body, a small image in a webhook payload, binary credentials in an HTTP header, or a signed token. For large files, prefer multipart uploads or pre-signed URLs — Base64 inflates the payload and is parsed entirely in memory.

Absolutely not. Base64 is trivially reversible and offers no protection. Passwords should be hashed with a slow, salted algorithm such as bcrypt, scrypt or Argon2. Use Base64 only to encode the resulting binary hash or salt for storage as text — never as a security measure on its own.

Yes. The File tab accepts PDFs, Office documents, text files, archives, audio and video. It reports the size and detected MIME type and produces the Base64 plus an optional Data URI. Reconstruction on decode preserves the original bytes exactly.

Because encoding happens entirely in your browser memory, very large files can be slow or hit browser limits. This tool comfortably handles files up to tens of megabytes. For multi-hundred-megabyte assets, a streaming server-side pipeline is a better fit than in-browser Base64.

Never. All encoding, decoding, file conversion and JWT decoding run locally using standard Web APIs. Your text, files and tokens never leave your device, are never logged and are never stored remotely — making the tool safe for confidential and regulated data.

For ASCII you can use btoa(str), but it breaks on Unicode. The correct, Unicode-safe approach is btoa(String.fromCharCode(...new TextEncoder().encode(str))) to encode, and new TextDecoder().decode(Uint8Array.from(atob(b64), c => c.charCodeAt(0))) to decode. This tool uses exactly that technique under the hood.

Use the base64 module: base64.b64encode(data.encode()).decode() to encode a string and base64.b64decode(b64).decode() to decode. For URL-safe output use base64.urlsafe_b64encode. Remember to encode/decode the string to bytes first, since the functions operate on bytes.

Use the base64 utility: echo -n "text" | base64 to encode, and echo "encoded" | base64 -d to decode. Add the -w 0 flag to disable line wrapping. On macOS the same command exists, and openssl base64 works cross-platform.

Encoding (like Base64) transforms data into another format for safe transport and is fully reversible by anyone. Encryption transforms data using a secret key so that only someone with the key can recover it. Encoding is about compatibility; encryption is about confidentiality. They solve different problems.

Pure Base64 does not, but the MIME variant inserts a CRLF every 76 characters, and pasted strings often pick up stray line breaks. Decoders should ignore whitespace, which this tool does — it strips all spaces, tabs and newlines before decoding so wrapped or copy-pasted strings still work.

Encode the image in the File tab, then use the generated Data URI like this: background-image: url("data:image/png;base64,iVBORw0K…"). The Data URI tab outputs this snippet ready to paste. Inlining avoids an extra HTTP request, which is ideal for tiny icons.

Data URIs remove a network round-trip, which speeds up rendering of small, critical assets like inline SVG icons or above-the-fold thumbnails. The trade-offs are the 33% size increase and that inlined assets cannot be cached separately, so reserve them for small, rarely-changing resources.

Yes. The Auto-detect engine inspects your input and recognizes JWTs, Data URIs, Base64-encoded JSON/XML/HTML, encoded images and files (via magic-number signatures), hex, binary and URL-encoded text — then suggests the right one-click action for each.

Entropy estimates how random the characters are, measured in bits per character. Compressed or encrypted data approaches the theoretical maximum (~6 bits for Base64), while repetitive or structured text scores lower. It is a quick heuristic for telling random keys apart from encoded plain text.

Yes. Once the page has loaded, all core features keep working without a connection because everything runs client-side. You can encode, decode, convert files and decode JWTs on a plane or behind a firewall with no internet access.

Use the Convert tab. Paste a value in any format — text, Base64, URL-safe Base64, hex, binary or URL-encoded — and the tool decodes it to raw bytes and re-renders it in every other format simultaneously, so you can read the same data however you need it.

Yes. The alphabet includes both uppercase and lowercase letters, and they map to different values, so changing the case of a Base64 string corrupts it. This differs from hex, where case does not matter. Always preserve the exact casing when copying Base64.

No. Base64 is a lossless, one-to-one mapping between byte sequences and encoded strings (ignoring optional whitespace and padding differences). The same bytes always produce the same output, and every valid Base64 string decodes back to exactly one byte sequence.

RFC 4648 defines the canonical Base64 and Base64URL alphabets with no line wrapping. RFC 2045 (MIME) uses the standard alphabet but mandates 76-character lines for email bodies. They share the same characters; the difference is whether line breaks are inserted.

Use URL-safe Base64. Standard Base64 contains “+”, “/” and “=”, which must be percent-encoded in URLs and can cause subtle bugs. URL-safe Base64 (- and _ with no padding) drops cleanly into query parameters and path segments. The tool produces it directly in the Encode and Convert tabs.

The File tab focuses on one file at a time with a preview and stats so you can verify each result. For automated batch pipelines, a script using the same encoding logic (shown in the code examples) is the right approach. Drag a new file in at any time to replace the current one.

That usually means the bytes are not UTF-8 text — they may be a binary file (image, PDF, compressed data) or text in a different character set. The tool flags non-text output and offers to decode it as a file instead, where the magic-number detector identifies the real format.

Yes, completely free with no sign-up, no usage limits and no watermarks. Encode, decode, convert files, build Data URIs and decode JWTs as much as you like. An optional Pro tier removes ads and raises in-browser file limits, but every core feature is free forever.

Common actions are bound: Ctrl/Cmd + Enter swaps between Encode and Decode, Ctrl/Cmd + C copies the output when the editor is focused via the Copy button, Ctrl/Cmd + K clears the input, and Ctrl/Cmd + / opens the shortcuts panel. Native undo/redo works inside the editor.