Base64 Encoder Decoder guide
Encode text to Base64 or decode a Base64 string back to readable text for APIs, data URIs, email headers, and debugging. Text is converted as UTF-8 first, so accented letters and emoji survive the round trip. Output updates as you type, the URL-safe option produces Base64URL, and you can encode a whole file or download decoded binary data.
How Base64 works
Base64 turns any bytes into text built from 64 safe characters: A to Z, a to z, 0 to 9, plus + and /. It reads the input 3 bytes (24 bits) at a time and splits them into four 6-bit groups. Each 6-bit value, 0 to 63, maps to one character. Three bytes in, four characters out.
The word 'Man' is the classic example from RFC 4648. Its bytes are 77, 97, and 110, or 01001101 01100001 01101110 in binary. Regrouped into six-bit chunks, that is 19, 22, 5, and 46, which map to T, W, F, and u. So 'Man' becomes 'TWFu'.
Padding and the = sign
When the input length is not a multiple of 3, the last group is short. Base64 pads it with zero bits and adds = signs so the output length stays a multiple of 4. One leftover byte produces two = signs; two leftover bytes produce one. 'Hi' is two bytes, so it encodes to 'SGk='. 'H' alone becomes 'SA=='.
Output size is always 4 × ceil(n ÷ 3) characters for n bytes, roughly 33 percent larger than the input. A 3 MB image becomes a 4 MB string. That overhead is why inlining big images as data URIs usually hurts page speed, while tiny icons under a few kilobytes can be worth it to save a request.
Text, UTF-8, and why some tools break
Base64 encodes bytes, not letters, so text must first become bytes. This tool converts text to UTF-8, the encoding used almost everywhere on the web, and then encodes it. 'héllo 👋' becomes 'aMOpbGxvIPCfkYs=', and decoding gives the same text back.
The browser's built-in btoa function only accepts characters up to code 255 and throws an error on emoji or most non-Latin text. Tools that call it directly fail on anything beyond basic English. Going through UTF-8 first avoids that. The reverse can fail too: if a Base64 string holds an image or other binary data rather than text, decoding it as UTF-8 produces an error, which is the correct answer.
Where you'll see Base64
Email attachments are sent as Base64 under the MIME standard, because email was designed for plain text. Data URIs embed files in HTML and CSS as data:image/png;base64,.... HTTP Basic authentication sends 'username:password' as Base64, so 'user:pass' becomes 'dXNlcjpwYXNz'. That is readable by anyone who intercepts it, which is why Basic auth is only acceptable over HTTPS.
JSON Web Tokens use Base64URL for each of their three sections, and many APIs return binary data, such as PDFs or images, as Base64 strings inside JSON. Kubernetes secrets and many config files store values the same way.
Base64 versus Base64URL
Standard Base64 uses + and /, which have special meanings in URLs and file names. Base64URL, also defined in RFC 4648, swaps them for - and _ and usually drops the = padding. JWTs, URL parameters, and some file-naming schemes use it.
This tool decodes both alphabets automatically and does not need the padding, so you can paste a Base64URL string as is. To produce Base64URL, tick URL-safe: the output uses - and _ and drops the = padding. A standard decoder elsewhere needs the reverse: replace - with + and _ with /, then add = signs until the length is a multiple of 4. For JWTs specifically, the JWT decoder does all of that and shows the header and payload as formatted JSON.
Mistakes to avoid
Treating Base64 as security is the big one. It is an encoding, not encryption; there is no key and decoding takes milliseconds. Credentials, API keys, and personal data in Base64 are effectively plain text. Use real encryption or a hash, depending on the goal.
Other common problems: copying a string with a leading 'data:...;base64,' prefix, surrounding quotes, or line breaks inserted every 76 characters by email tools. Strip those before decoding. Everything here runs locally, so pasted tokens and credentials never leave your browser, which matters more than usual for a tool people feed secrets into.
How we calculate: sources
Frequently asked questions
What is Base64 encoding?
A way to represent binary data using 64 printable characters: A-Z, a-z, 0-9, + and /, with = for padding. Every 3 bytes of input become 4 characters, so 'Man' encodes to 'TWFu'.
Is Base64 encryption?
No. Anyone can decode it instantly; there is no key. Never use Base64 to hide passwords or secrets. Use it only to move data safely through systems that expect text.
How much bigger does Base64 make data?
About 33% bigger, because 3 bytes become 4 characters. A 3 MB file becomes 4 MB of Base64 text, before any line breaks some formats add.
What does the = at the end mean?
Padding. Input is processed in 3-byte groups; if the last group has 1 byte, two = signs are added, and if it has 2 bytes, one = sign. 'Hi' encodes to 'SGk='.
What is Base64URL?
A URL-safe variant defined in RFC 4648 that replaces + with - and / with _, and often drops the = padding. JWTs use it. This tool decodes Base64URL automatically, and the URL-safe checkbox encodes to it.
Why do I get an error when decoding?
The input contains characters outside the Base64 alphabet, is missing padding, or decodes to bytes that are not valid UTF-8 text (for example, an image). Remove spaces, quotes, and data: prefixes and try again.
Is my data uploaded?
Everything runs in your browser. Nothing you enter is uploaded to a server or stored by us.
Can Base64 be decoded without a key?
Yes. Base64 has no key or secret. Anyone with the string can decode it instantly, so it provides no confidentiality.