Base64 Encoder / Decoder

Using the encoder and decoder

1. Paste text into the Input box.
2. Encode turns the text into Base64. Decode turns Base64 back into text. Nothing happens until you press one of the buttons.
3. Copy copies the Output box. The button reads Copied! for a moment when it works.

Some things to know before you start:

• The tool works with text only. There is no file upload. To turn a picture into Base64, use the Image to Base64 tool.
• The output is always one long line. The tool does not add a line break every 76 characters, as email (MIME) encoders do.
• If Decode fails, a message under the buttons says why, and the Output box is cleared. So you cannot copy an old result by mistake.

How Base64 works: a worked example

Base64 turns bytes into text that uses only 64 safe characters: A-Z, a-z, 0-9, + and /. Each character carries 6 bits. So every 3 bytes (24 bits) become 4 characters.

Here is what happens when you encode Hi!:

Text:        H         i         !
Bytes:       72        105       33
Bits:        01001000  01101001  00100001
6-bit groups: 010010  000110  100100  100001
Numbers:      18      6       36      33
Base64:       S       G       k       h

The result is SGkh. Number 0 is A, 26 is a and 52 is 0. So 18 is S and 36 is k.

What the = signs mean

When the input is not a multiple of 3 bytes, the last group is filled with = so the output length is still a multiple of 4:

• Hi! (3 bytes) becomes SGkh with no padding.
• Hi (2 bytes) becomes SGk=.
• H (1 byte) becomes SA==.

The output is always about 33% bigger than the input. The exact length is 4 × (bytes ÷ 3, rounded up). hello world is 11 bytes and becomes 16 characters: aGVsbG8gd29ybGQ=.

Text in other languages and emoji

Base64 works on bytes, not letters. So the tool first turns your text into UTF-8 bytes, then encodes those. This is why non-English text grows more than you might expect:

The browser's own btoa() function cannot do this alone. btoa("नमस्ते") throws an error, and btoa("é") gives 6Q==, which is the old Latin-1 form. This tool adds the UTF-8 step, so its results match other modern tools and command-line base64. Decode reverses the same steps.

A rare case: text copied from some programs can contain half of an emoji (a broken character). The tool encodes that half as the replacement character � (UTF-8 bytes EF BF BD) and shows a note, so you know the result is not exactly your text.

What Decode accepts and rejects

These results come from the tool's own decode function:

The last row needs a short explanation. Decode must show the result as text, so it checks that the bytes are UTF-8 text. Images, PDFs, zip files and encrypted data are not text. For those, the tool tells you the Base64 is fine but the data is binary, and shows how many bytes it has.

URL-safe Base64

Some systems use a URL-safe form of Base64. It uses - instead of + and _ instead of /, and it often drops the =. JSON Web Tokens (JWTs) use it. Decode reads both forms. It treats - as + and _ as /, and adds any missing = signs. For example, 8J-YgA decodes to 😀. Encode always gives the standard form. To make URL-safe output, change every + to - and every / to _ after encoding, and remove the = signs.

Where Base64 is used

• HTTP Basic authentication. The header Authorization: Basic dXNlcjpwYXNz is just user:pass in Base64. Paste dXNlcjpwYXNz into the tool and press Decode to see it.
• JWT headers and payloads. A JWT has three parts separated by dots. The first two are URL-safe Base64 of JSON. eyJhbGciOiJIUzI1NiJ9 decodes to {"alg":"HS256"}. You can paste each part straight into the tool. The third part is a signature in binary, so Decode says it is binary data, not text.
• Data URIs. Small icons or SVGs can go straight into HTML or CSS as data:image/svg+xml;base64,....
• Email attachments and JSON APIs that must carry binary data inside a text format.

Base64 is not encryption

Base64 has no key and no secret. Anyone can decode it in one step, as the Basic authentication example shows. It only changes how data looks. Do not use it to hide passwords, API keys or personal data. If data must stay private, encrypt it, and send it over HTTPS.

Base64 is also a poor fit for large files. The output is a third bigger. A large image inside a data URI also makes the HTML or CSS file bigger, and the browser cannot cache the image on its own. For anything more than a small icon, a normal image file is usually better.

Common mistakes

• A hidden newline from the command line. echo hello | base64 gives aGVsbG8K, but this tool gives aGVsbG8= for hello. echo adds a newline at the end, and the newline is encoded too. Use printf '%s' hello | base64 to match.
• Encoding twice. If you press Encode on text that is already Base64, you get Base64 of Base64. SGkh becomes U0draA==. Decode it twice to get back to Hi!.
• Copying the prefix. Remove data:...;base64, or Basic before you decode.