Base64 Encode & Decode
Convert text to Base64 or decode it back, with an optional URL-safe mode - all in your browser.
Base64 is how binary data survives a text-only journey. Email attachments, JSON payloads, data URLs and Authorization headers all lean on it because its alphabet - A-Z, a-z, 0-9, plus, slash - contains only characters that plain-text protocols and JSON strings handle without corruption. This tool converts between readable text and its Base64 form in either direction, with an optional URL-safe variant for tokens and query strings.
The encode direction reads your text as UTF-8 bytes and produces the matching Base64 string. The decode direction reverses the process and recovers the original text, validating the input as it goes. Because the conversion happens at the byte level, multi-byte characters such as emoji and CJK text round-trip correctly instead of coming back as mojibake.
Everything runs in your browser. The content you paste never leaves the page, so you can encode credentials, tokens or other sensitive strings without handing them to a third party. There is no upload, no file stored on a server and no retention policy to manage - the result exists only until you leave or refresh the tab.
Features
- Encode text to Base64, or decode Base64 back to readable text in one place.
- UTF-8 aware, so emoji, accents and CJK characters encode and decode correctly.
- URL-safe mode (RFC 4648 section 5) for tokens and query-string values.
- Whitespace-tolerant decoding that handles line-wrapped input.
- Automatic padding repair on decode, so a missing "=" is not a blocker.
- Clear error message when the input is not valid Base64.
- Runs fully offline - nothing is transmitted, logged or stored.
How to Use
- 1
Paste your text
Drop the string you want to convert into the input box. It can be plain text, a token, or an already-encoded Base64 string.
- 2
Pick a direction
Choose Encode to turn text into Base64, or Decode to recover text from Base64. The button label changes to match.
- 3
Enable URL-safe when needed
Tick URL-safe when the result will sit in a URL or query string. The tool swaps "+" for "-", "/" for "_" and strips the padding.
- 4
Run and copy
Press the button, review the result, and copy it. The output box also offers a one-click download for larger values.
Example
Text to Base64
hello world↓
aGVsbG8gd29ybGQ=URL-safe Base64 to text
aGVsbG8gd29ybGQ↓
hello worldCommon Problems
Missing padding
Standard Base64 uses "=" padding so that every group is four characters. Many encoders emit unpadded output, and many decoders refuse it. This tool re-pads automatically on decode, so a missing "=" is handled instead of throwing.
Confusing URL-safe and standard alphabets
A URL-safe string uses "-" and "_" where standard Base64 uses "+" and "/". Passing one to the other produces garbage or an outright error. Use URL-safe mode for anything destined for a URL, and standard mode everywhere else.
Treating Base64 as encryption
Base64 is an encoding, not a cipher. Anyone can decode it without a key. It exists to transport bytes through text-only channels, so never rely on it to protect a secret - pair it with real encryption when confidentiality matters.
Encoding non-ASCII text with the wrong charset
Naive tools read bytes as Latin-1, so "café" becomes mojibake after a round trip. This tool always interprets input as UTF-8, so accented letters and CJK text encode and decode consistently.
Decoding strings that were never Base64
Random text rarely decodes cleanly. The tool validates the alphabet and length, and reports a clear error instead of producing garbage output you might mistake for the real value.
Technical Details
Base64 takes three bytes of input and emits four characters from a 64-character alphabet, padding short groups with "=". Each output character carries six bits of the payload, which is why the encoded form is about a third larger than the source.
The URL-safe variant replaces "+" and "/" with "-" and "_" and omits padding, matching RFC 4648 section 5. This keeps the output valid inside URL query strings where "+" means a space and "/" would alter the path.
All conversions are performed locally in the browser using the platform TextEncoder, so byte handling matches the UTF-8 encoding that servers and APIs expect.
Encoding is reversible by design and provides no confidentiality. If the goal is secrecy, combine it with an authenticated cipher rather than expecting Base64 to protect anything.
Padding is required in standard Base64 so every group has exactly four characters, which is why short inputs end in "=". URL-safe output drops the padding entirely, because the receiving side is expected to restore it before decoding.
Frequently Asked Questions
What is Base64 used for?
Moving binary data through text-only systems: email attachments (MIME), data URLs, JSON payloads that must embed bytes, and HTTP Authorization headers that carry access tokens. It converts bytes into a safe alphabet of letters, digits and two symbols.
Is Base64 safe to store passwords in?
No. Base64 is trivially reversible by design, so it provides zero protection. Passwords should be stored as salted hashes, not as any reversible encoding.
Does this tool upload my data?
No. Encoding and decoding run entirely in your browser tab. The input never touches a server, is never logged, and disappears when you close the page.
What does URL-safe mode change?
Two characters and the padding. "+" becomes "-", "/" becomes "_", and trailing "=" is removed so the string is safe inside URLs and file names. Decoding the same way converts it back.
Why does the output look longer than the input?
Each Base64 character carries only six bits, so three bytes of input need four characters of output. That adds roughly 33% to the length, before the padding overhead on short values.
Can I decode Base64 that contains line breaks?
Yes. The decoder ignores whitespace, which is useful for certificate and key files that are wrapped at 64 or 76 columns. It still validates the meaningful characters.
Is Base64 encoding the same as encryption?
No. Encoding has no key and no secrecy - anyone who sees the string can decode it. Encryption scrambles data so only a key holder can recover it; Base64 merely repackages bytes for transport.
Data & Privacy
Your data stays in your browser. Nothing is uploaded.
- Processing
- Local
- Upload
- None
- Server Storage
- None
- Account
- Not required
Related Tools
URL Encoder / Decoder
Percent-encode text for safe use in URLs and query strings, or decode it back to readable form.
Encoding & Conversion
HTML Entity Encoder / Decoder
Convert HTML to its escaped entity form or decode entities back to readable markup.
Encoding & Conversion
Unicode Converter
Escape text as \uXXXX sequences or decode them back to readable characters, for JSON, JavaScript and Java.
Encoding & Conversion
Hex Converter
Convert text to hex bytes and back, revealing the UTF-8 representation of any string.
Encoding & Conversion
Binary Converter
Convert text to its 8-bit binary form and decode binary strings back to readable text.
Encoding & Conversion
URL Parser
Break any URL into protocol, host, path, query parameters and fragment for easy inspection.
Encoding & Conversion
Related Guides
How to Decode a JWT: Read the Header and Payload Without a Secret
Decode any JWT by splitting on the dots and base64url-decoding the header and payload. No secret is needed, because decoding is not signature verification.
Base64 Guide: What It Is and How to Encode and Decode
Base64 encodes binary data into 64 safe ASCII characters, adding about 33 percent size. Learn how padding works and why it is transport, not encryption.
Hash vs Encryption: What Is the Difference?
Hashing is one-way and deterministic; encryption is two-way with a key. Learn which protects passwords vs data in transit, and why the two differ.