Free Base64 Encoder & Decoder

What is Base64 — and why does everything use it?

Base64 is a binary-to-text encoding scheme defined in RFC 4648. It takes any bytes — text, an image, a PDF, a cryptographic token — and rewrites them using just 64 printable ASCII characters: A–Z, a–z, 0–9, plus + and /, with = as padding. The reason is transport: many systems that move data around only handle text safely. Email was built for 7-bit ASCII, JSON has no binary type, URLs and HTTP headers choke on raw bytes, and XML breaks on control characters. Base64 is the bridge that lets binary data travel through all of them unchanged.

You meet it constantly, usually without noticing. Email attachments ride inside MIME bodies as Base64. Small images are inlined into HTML and CSS as data URIs. API credentials travel as Base64 in Authorization headers. JSON Web Tokens are base64url segments. Certificates, keys, and embedded fonts are routinely Base64-encoded before being placed in config files. Whenever you see a long, apparently random string of letters, digits, + and /, there is a good chance it is Base64 — and this tool is how you find out what it actually contains.

How Base64 works, step by step

A byte is 8 bits. Base64 re-reads the same bits in chunks of 6, because 6 bits can take exactly 64 values (0–63), and each value maps to one printable character. The tool processes three bytes at a time: 3 bytes are 24 bits, and 24 bits are exactly four 6-bit chunks — so every 3 bytes of input become exactly 4 characters of output. That is also why Base64 output is always about 33% larger than the input: the price of travelling as text.

When the input length is not a multiple of 3, the last group is short and padding fills it: one leftover byte produces two = signs, two leftover bytes produce one. So “Hello World” (11 bytes) encodes to SGVsbG8gV29ybGQ= — 16 characters, one = of padding. Padding is a convenience for decoders, not a security feature: this tool accepts input with or without it and restores it automatically.

Standard vs URL-safe Base64 — and why JWTs use the second

The difference exists because + and / have special meaning inside URLs (+ means a space in query strings; / separates path segments). A token pasted into a URL with those characters intact will be corrupted in transit, which is why JSON Web Tokens always use the URL-safe alphabet — header.payload.signature, three base64url segments joined by dots, padding stripped. Paste one here and the JWT inspector decodes the header and payload into readable JSON. Note the honest limit: decoding a JWT tells you what it claims; it does not verify its signature. For that you need the signing key, which is exactly why the signature segment exists.

Base64 is not encryption — and other pitfalls

The single most important thing to understand about Base64 is what it is not. It is not encryption, not hashing, and not obfuscation that protects anything: there is no key, and anyone with any decoder — including this page — reverses it instantly. Encoding a password or an API secret in Base64 and calling it “hidden” is one of the most common security mistakes in software. Basic Auth headers are Base64-encoded credentials, and they are only safe inside HTTPS, where the transport itself is encrypted.

• Unicode needs UTF-8 first. Text must be converted to UTF-8 bytes before encoding. The browser's raw btoa() only handles Latin-1 and corrupts emoji and non-Latin scripts; this tool uses TextEncoder/TextDecoder, so Bengali, Arabic, Chinese, and emoji round-trip exactly.
• Whitespace is not an error. Base64 copied from emails and logs often contains line breaks and spaces. A forgiving decoder strips them; a strict one fails. This tool strips them, and also strips data-URI prefixes (data:image/png;base64,…) before decoding.
• Not every valid Base64 string is text. A decodes-to- binary result (an image, a PDF, a ZIP) is not a failure — it is a file. Use the download button and let the signature sniffing name the file type for you.
• Size grows by a third. Do not Base64-encode large files for transport unless you must: a 3 MB image becomes a 4 MB string. For data URIs, the rule of thumb is small assets only (under ~10 KB), where saving an HTTP request outweighs the overhead.

Doing it from the command line

For scripts and servers, every platform has a built-in equivalent. On Linux and macOS, echo -n "Hello" | base64 encodes and echo "SGVsbG8=" | base64 -d decodes. In Python, base64.b64encode(b"Hello") and base64.urlsafe_b64encode(...) cover both alphabets; in JavaScript, Buffer.from(text).toString("base64") and Buffer.from(b64, "base64url") do the same. The browser tool above exists for the interactive cases — inspecting a token, checking a payload, building a data URI — where opening a terminal would slow you down. For adjacent jobs, the JWT decoder gives a full token breakdown, the JSON formatter prettifies decoded JSON payloads, and the developer tools collection covers the rest of the workflow.