Base64 encode / decode
Encode or decode text and files to and from Base64.
Have feedback or an idea for this tool?
What is Base64 encoding?
Base64 is a way of representing binary data as plain ASCII text, using 64 safe characters so that bytes can travel through systems that expect text, such as email bodies, JSON fields, data URLs and HTTP headers. It encodes every three bytes as four characters, which makes the output about a third larger than the input, and it is an encoding, not encryption, so it provides no secrecy. This tool encodes text to Base64 or decodes Base64 back to readable text, running entirely in your browser. Enter a value and choose encode or decode. Use it to embed a small image or key in a config file, to inspect a token or data URL, or to move binary content safely through a text-only channel. Because it is reversible by anyone, never rely on it to hide sensitive values.
Key facts
- Base64 is a binary-to-text encoding that represents bytes using 64 printable ASCII characters: A-Z, a-z, 0-9, plus (+) and slash (/).
- Base64 encodes 3 bytes into 4 characters, making the output about 33 percent larger than the input.
- Base64 is encoding, not encryption, because anyone can decode a Base64 string back to the original bytes with no key.
- The base64url variant defined in RFC 4648 replaces + and / with - and _ so the output is safe in URLs, filenames and JWTs.
- The = character is padding added so the output length is a multiple of four, and base64url often omits it.
What Base64 is
Base64 is a binary-to-text encoding. It takes raw bytes and represents them using only 64 safe printable ASCII characters - A-Z, a-z, 0-9 and two symbols (+ and /) - so binary data can pass through systems that expect plain text.
It works in groups of 3 bytes (24 bits), which split into four 6-bit values, each mapping to one character in the 64-character alphabet. Because 3 bytes become 4 characters, the output is about 33% larger than the input.
A tiny example: the text 'Man' encodes to 'TWFu'. Decoding 'TWFu' gives back 'Man' exactly, byte for byte.
Encoding is not encryption
Base64 is encoding, not encryption. It hides nothing - anyone can decode a Base64 string back to the original bytes with no key and no secret. Do not use it to protect passwords, tokens or any sensitive data.
A common example is the HTTP Basic auth header: 'Authorization: Basic dXNlcjpwYXNz' is just 'user:pass' Base64-encoded, which is why Basic auth is only safe over HTTPS. Likewise a JWT's header and payload are Base64url, not encrypted, so never put secrets in them.
Where developers use it
Data URIs: embed a small image or font directly in HTML or CSS as data:image/png;base64,... so it loads without a separate request. Good for tiny assets; large ones bloat the file by ~33%.
Email (MIME): attachments and non-ASCII bodies are Base64-encoded so 8-bit binary survives mail servers that were built for 7-bit text.
APIs and JSON: JSON has no binary type, so file contents, images or raw bytes are carried as a Base64 string field.
Config and secrets files: certificates, keys and blobs are often stored Base64-encoded so they fit on a single text line (encoded, still not encrypted).
Base64 vs base64url and padding
Standard Base64 uses + and / as its last two characters, but those are unsafe in URLs and filenames. The base64url variant (RFC 4648) swaps them for - and _ so the output can go straight into a query string, a path segment or a JWT.
The = character is padding. Since input is processed in 3-byte blocks, a final block of 1 or 2 bytes is padded with = so the output length is always a multiple of 4. base64url often drops the padding entirely.
So the same bytes can appear as 'a+b/c==' in standard Base64 or 'a-b_c' in unpadded base64url. Decode with the matching variant or you will get errors or wrong bytes.
Glossary
- Base64
- Base64 is a binary-to-text encoding that represents bytes using 64 printable ASCII characters (A-Z, a-z, 0-9, plus and slash), so binary data can pass through text-only systems. Every 3 bytes become 4 characters.
- Encoding vs encryption
- Base64 is encoding, not encryption: there is no key and anyone can decode a string back to the original bytes. It must never be used to protect passwords, tokens or other secrets.
- base64url
- base64url is a URL-safe variant defined in RFC 4648 that replaces the plus and slash characters with hyphen and underscore, so the output is safe in URLs, filenames and JWTs, and often omits padding.
- Padding
- Padding is the equals character added so the output length is a multiple of four. A final block of one byte gets two equals signs and a block of two bytes gets one; base64url frequently drops it.
- Size overhead
- Base64 output is about 33 percent larger than the input because three input bytes are represented by four output characters. This is why data URIs suit small assets rather than large files.
- Data URI
- A data URI embeds bytes inline as data:mediatype;base64,DATA so a small image or font can load directly from HTML or CSS without a separate request. The part after the comma is the Base64 payload.
Questions, answered.
Is my text sent to a server?+
No. Encoding and decoding happen entirely in your browser, so any text, token or file you paste stays on your machine and is never uploaded.
How do I decode a Base64 string?+
Paste the string, choose 'Decode', and the original text or bytes appear. For example 'TWFu' decodes to 'Man'. If it fails, check for a wrong variant (standard vs base64url) or stray whitespace and characters that are not part of Base64.
How do I encode text to Base64?+
Paste the text, choose 'Encode', and read the result. The output uses the 64-character alphabet (A-Z, a-z, 0-9, + and /) and is about 33% longer than the input, since every 3 bytes become 4 characters.
Can I decode Base64 to an image or PDF?+
Yes. Decode the Base64 string, then download the result as a file. If the data starts as a data URI like 'data:image/png;base64,...', strip everything up to and including the comma first, then decode the part that follows.
Is Base64 a form of encryption?+
No. Base64 is encoding, not encryption. There is no key and anyone can decode it back to the original bytes, so never use it to protect passwords, API keys or secrets.
What is the difference between Base64 and base64url?+
They share the same alphabet except for the last two characters. Standard Base64 uses + and /, while the URL-safe base64url variant uses - and _ so the output is safe in URLs, filenames and JWTs. base64url also often omits the = padding.
Why does Base64 end with one or two = signs?+
The = is padding. Input is encoded in blocks of 3 bytes; when the last block has only 1 or 2 bytes, = characters are added so the output length is always a multiple of four. A final block of 1 byte gets '==' and 2 bytes gets '='.
Does Base64 make my data larger?+
Yes, by roughly 33%. Three bytes of input become four Base64 characters, so a 300 KB file becomes about 400 KB encoded. That is why data URIs suit small assets, not large ones.
Cloud that speaks India.
These tools run on ServerCake infrastructure in India. When our cloud opens, you get VMs and managed databases priced in ₹, billed with GST, on India-resident infrastructure. Reserve your spot for early access.
Reserve your spot