Base64 Encoder / Decoder
Encode text to Base64 or decode a Base64 string back to readable text. Supports UTF-8, Unicode, and emoji. Nothing is sent to any server.
All encoding and decoding happens instantly in your browser, so nothing is sent to any server. Supports UTF-8 text including Unicode characters.
How to encode or decode Base64
Pick a direction, paste text or Base64, and copy the result.
- 01
Choose Encode or Decode
Encode turns text into Base64. Decode turns a Base64 string back into text. The swap button flips the direction and moves the output into the input.
- 02
Paste your input
Text is treated as UTF-8, so Hindi, Chinese, accents and emoji round-trip correctly. नमस्ते encodes to 4KSo4KSu4KS44KWN4KSk4KWH and decodes back exactly.
- 03
Copy the result
The output updates as you type. If a decode fails, the input isn't valid standard Base64, often because it's the URL-safe variant described below.
How Base64 works, and why it adds a third
Base64 takes the input three bytes at a time, splits those 24 bits into four groups of 6, and writes each group as one of 64 safe characters: A–Z, a–z, 0–9, + and /. So every 3 bytes become 4 characters, and encoded data is always about 33% bigger. A 3,000-byte input becomes exactly 4,000 characters.
When the input isn't a multiple of three bytes, = signs pad the end. a encodes to YQ==, ab to YWI= and abc to YWJj with no padding. Hello, world! becomes SGVsbG8sIHdvcmxkIQ==. The padding tells the decoder how many bytes the last group really holds.
Standard Base64 versus Base64url
The + and / characters cause trouble in URLs and file names, so a variant called Base64url swaps them for - and _ and usually drops the = padding. JWTs, many web APIs and some OAuth flows use it.
| Standard Base64 | Base64url | |
|---|---|---|
| Characters 62 and 63 | + and / | - and _ |
| Padding | = or == at the end | Usually omitted |
| Where you'll see it | Email attachments, data URIs, Basic auth | JWTs, URL parameters, file names |
| Supported by this tool | Yes | Not directly |
To decode Base64url here, replace each - with + and each _ with /, then add = until the length is a multiple of four. For JWTs, the JWT Decoder does all of that for you.
When Base64 is the right choice, and when it isn't
Base64 exists to move bytes through channels built for text. Email, JSON, XML, HTTP headers and URLs can all break on raw binary data or on certain characters, and Base64 sidesteps that by using only letters, digits and two symbols. That's why email attachments, data URIs, Basic auth headers and JWTs all use it.
It's the wrong choice when size matters. Every Base64 payload is a third bigger than the original, and inlined data can't be cached separately by the browser. A 3 KB icon embedded as a data URI is reasonable; a 300 KB photo embedded in CSS makes every page using that stylesheet slower. For anything over a few kilobytes, a normal file reference is usually better.
Where Base64 shows up
Building a Basic auth header
Encode username:password and send it as Authorization: Basic followed by the result. user:pass becomes dXNlcjpwYXNz.
Reading an encoded config value
Kubernetes secrets and some environment files store values in Base64. Decode them to check what's actually set.
Checking an API payload
Some APIs return text fields Base64-encoded. Decode one to confirm it holds what you expect.
Limits worth knowing
- Text only. There's no file upload; for images, use Image to Base64, which also builds the data URI.
- Decoded binary data, such as an encoded PDF, won't display as readable text and may show an error.
- Line breaks inside Base64 from email (MIME wraps lines at 76 characters) can make decoding fail. Remove them first.
- Base64 isn't security. Anyone can decode it, so never treat an encoded password or key as protected.