Base64 Encode / Decode

Details

About this tool

Encodes text to Base64 and decodes it back, in both the standard and the URL-safe alphabet. Decoding accepts either variant regardless of the switch, and a data: URL prefix is stripped for you.

Base64 exists because a lot of the internet was built to carry text and nothing else. Email headers, JSON string fields, XML attributes, HTTP headers and cookies all expect printable characters, and raw bytes passing through them get mangled - a stray newline or a byte above 127 and the message is corrupt. Base64 solves that by rewriting three bytes as four characters drawn from a 64-character alphabet that survives anything. The cost is fixed and known: the result is a third larger than the input.

The URL-safe variant swaps the two characters that cause trouble in a web address. Standard Base64 uses + and /, which mean something else in a query string, so the URL-safe alphabet uses - and _ instead and drops the = padding, since = also has to be escaped. JWTs use this variant throughout, which is why a token's parts decode here but not in a strict standard-alphabet decoder.

UTF-8 is where naive implementations break. The browser's own btoa throws on any character above U+00FF, so "café" fails and an emoji is impossible; the only correct route is to convert the text to UTF-8 bytes first and encode those. This tool always does that, which is why a Polish or Japanese string round-trips unchanged. Everything runs in your browser, which matters because Base64 is what tokens, credentials and API payloads are usually wrapped in.

Good to know

Questions people actually ask

Is Base64 encryption?

No, and treating it as such is a real security mistake rather than a pedantic one. Base64 is an encoding: there is no key, and anyone can decode it in one step. It hides nothing. Its job is to let arbitrary bytes travel through a channel that only accepts text - not to protect them.

What is URL-safe Base64?

The same encoding with two characters swapped and the padding dropped: - and _ replace + and /, and the trailing = signs are removed. Both of the replaced characters mean something in a URL, and = has to be percent-encoded, so the standard alphabet would need escaping to survive a query string. JWTs use the URL-safe variant everywhere.

Why did my accented text or emoji break somewhere else?

Because the encoder skipped the UTF-8 step. JavaScript's btoa operates on a binary string and throws on anything above U+00FF, so "café" fails outright and an emoji cannot be represented. The text has to become UTF-8 bytes before encoding. This tool does that, so anything you paste round-trips exactly.

Why is my Base64 longer than the original?

Because four characters are used for every three bytes, so the output is about 33% larger, plus padding. That overhead is why embedding images as data: URLs makes a page heavier than linking the same files, and why Base64 is a transport wrapper rather than a compression step.

Can I decode a data: URL?

Yes. The data:image/png;base64, prefix is recognised and removed, so you can paste a whole data URL from a stylesheet or an HTML attribute without trimming it first. Whitespace and line breaks are ignored too, which is what makes pasting from an email header work.