Base64 Encoder / Decoder

Encoding text to Base64

Base64 (RFC 4648) writes binary data using 64 safe characters: A–Z, a–z, 0–9, + and /. Every 3 bytes become 4 characters: Man is the bytes 77, 97, 110, whose 24 bits split into four 6-bit values (19, 22, 5, 46), which are T, W, F, u. When the input isn't a multiple of 3 bytes, = pads the end.

Text is first converted to bytes. This tool uses UTF-8, the encoding of the web, so any character works. The browser's built-in btoa() only accepts Latin-1 and throws an error on € or emoji, a common surprise when encoding in JavaScript. Wrap at 76 characters splits the output into lines, as MIME email (RFC 2045) requires.

Decoding Base64

Paste Base64 with Action set to Decode. Spaces and line breaks are ignored, so wrapped email bodies and PEM blocks decode directly. Missing = padding is accepted, and the URL-safe alphabet is recognized automatically. A data:image/png;base64, prefix is stripped, and its type is shown.

The decoder reports problems precisely: a character that isn't Base64 (with its position), = in the middle, or a length that can't be valid. If the decoded bytes aren't valid UTF-8 text, it tells you what kind of file they look like (PNG, PDF, ZIP…) and suggests Decode to file in File mode.

Files and images (data URIs)

In File mode any file up to 25 MB can be encoded. Images get a preview, and Copy data URI gives you a string like data:image/png;base64,iVBORw0KGgo… that works directly in HTML or CSS:

<img src="data:image/png;base64,iVBORw0KGgo…" alt="…">
background-image: url("data:image/svg+xml;base64,…");

Inlining saves a request, but Base64 is about 33% larger than the file and can't be cached separately, so it suits small icons rather than photos. For SVG, URL-encoding the markup is usually smaller than Base64.

URL-safe Base64

+ and / have meanings in URLs and file names, so RFC 4648 §5 defines a URL-safe alphabet that uses - and _ instead and usually drops the = padding. JSON Web Tokens, many API keys and some cloud storage signatures use it. Choose Alphabet: URL-safe to encode that way. Decoding accepts either alphabet, with or without padding, and the footer says when the URL-safe form was detected.

Example: Hi?> is SGk/Pg== in standard Base64 and SGk_Pg in URL-safe Base64.

Base64 is encoding, not encryption

Anyone can decode Base64: there is no key. It exists so binary data can travel through systems built for text, such as email, JSON, XML and URLs. Credentials sent with HTTP Basic authentication are only Base64-encoded, which is why that scheme is safe only over HTTPS. To protect data, encrypt it (for example with AES, using a key from the encryption key generator); to fingerprint it, use the hash generator.