Base64 Encoder / Decoder

Encode text to Base64 and decode Base64 strings back to text.

🔒 Everything happens in your browser — your data is never uploaded.

What Does the Base64 Encoder / Decoder Do?

This tool converts text to Base64 and decodes Base64 strings back to readable text, entirely in your browser. It is fully UTF-8 aware — emoji, accents and any world script encode and decode correctly — and it supports the URL-safe Base64 variant (using - and _ instead of + and /) used in JWTs and web tokens.

Base64 is not encryption: it is an encoding that represents binary data using 64 printable characters, so any data can travel safely through channels designed for plain text — JSON fields, XML documents, URLs, email bodies and HTTP headers.

How to Use the Tool

  1. Choose Encode or Decode with the tabs.
  2. Type or paste into the left box — the result appears live on the right.
  3. Tick URL-safe variant when working with JWTs or URL parameters.
  4. Copy the output with one click. Invalid Base64 input produces a clear error instead of garbage.

Where You Meet Base64 Every Day

  • Data URIs — images embedded directly in HTML/CSS are Base64 strings (data:image/png;base64,…).
  • JSON Web Tokens — each of a JWT's three dot-separated sections is URL-safe Base64; decode them here to inspect the payload.
  • HTTP Basic Auth — the Authorization header carries user:password Base64-encoded.
  • Email attachments — MIME encodes binary attachments as Base64 text.
  • API payloads — binary blobs (images, PDFs, certificates) shipped inside JSON fields.

Frequently Asked Questions

Is Base64 a form of encryption?

No — it is a reversible encoding, not encryption. Anyone can decode it instantly (this page proves it). Never treat Base64 as a way to hide passwords or secrets.

Why is Base64 output about 33% longer than the input?

Base64 represents every 3 bytes of data with 4 characters, so encoded data is 4/3 the original size — the cost of using only printable characters.

What is the URL-safe variant?

Standard Base64 uses + and /, which have special meanings in URLs. The URL-safe alphabet replaces them with - and _ and usually drops the trailing = padding. It is the flavor used in JWTs. The decoder here accepts both variants automatically.

Why does decoding my string fail?

The input probably contains characters outside the Base64 alphabet, has been truncated, or is missing characters. Check that you copied the complete string — length should be a multiple of 4 after padding.