Base64 Encode / Decode
Text to Base64 and back. UTF-8 safe, with a URL-safe alphabet toggle.
Encoded as UTF-8 before Base64, so emoji and accents survive.
SGVsbG8sIHdvcmxkIQ==
UTF-8 → bytes → 6-bit groups → A–Z a–z 0–9 + / (= padding)
Base64 is encoding, not encryption. Anyone holding the string can decode it.
How it works
Paste or type into the input. Encode reads it as text; decode reads it as Base64.
Pick a direction. Encode turns text into Base64; decode turns Base64 back into text.
Turn on URL-safe if the string has to survive a URL or a JWT: + becomes -, / becomes _, and the trailing = padding is dropped.
The output updates on every keystroke and copies with one button. Encoding runs in the page, so the text never leaves the browser.
What the encoding actually does
Base64 reads the input as bytes, splits the byte stream into 6-bit groups, and maps each group to one of 64 printable ASCII characters (A–Z, a–z, 0–9, + and /). Three bytes become four characters, so the output is 4/3 the size of the input — about 33% larger — padded with = to a multiple of four.
Hello → 48 65 6C 6C 6F → 010010 000110 010101 101100 011011 000110 1111 → SGVsbG8=
Use cases
Data URIs in CSS
A small icon inlined as data:image/png;base64,… saves a request. Worth it under roughly 2 KB; past that the 33% size penalty costs more than the round trip does.
MIME email attachments
SMTP is a 7-bit protocol, so binary attachments are Base64-encoded before transport. That constraint is the reason the encoding exists at all.
JWT header and payload
A JWT is three Base64URL segments joined by dots. Decode the middle one with URL-safe on to read the claims — a JWT is signed, not encrypted, so the payload is readable by anyone holding it.
Basic auth headers
Authorization: Basic carries Base64 of user:password. Decoding the header is how you check which credential a client actually sent, rather than which one you think it sent.
Keys and certificates in config
A PEM body is Base64 of DER. Collapsing a binary key to one line of ASCII is what lets it survive an environment variable, a YAML field, or a CI secret.
Webhook signatures
HMAC digests are usually transmitted as Base64 or Base64URL. Decode before comparing, so you are comparing raw bytes and not two different spellings of the same digest.
One-line configuration
A multiline file encoded to a single Base64 string passes through a shell argument or a kubectl flag without quoting or newline problems.
URL-safe versus standard
RFC 4648 §5 swaps + for - and / for _ so the string survives a query string or a path segment unescaped, and usually drops the = padding. Decoders restore the padding from the length, which is why this tool accepts either form.
Questions
- Is it UTF-8 safe?
- Yes. Text is converted to UTF-8 bytes before encoding, so emoji, accented characters and non-Latin scripts round-trip unchanged.
- What does the URL-safe toggle change?
- It swaps + for - and / for _ and drops the trailing = padding — the Base64URL alphabet from RFC 4648 §5, which is what JWTs and signed URLs use.
- Is anything sent to a server?
- No. Both directions run in the browser. The text is never uploaded, logged, or stored.
- Why did decoding fail?
- The input contains a character outside the alphabet in use, or its bytes are not valid UTF-8. Whitespace and missing = padding are tolerated; a stray character or the wrong alphabet is not — if the string came from a JWT, turn URL-safe on.
- Is Base64 encryption?
- No. It is a reversible mapping with no key. Anyone holding the string can read it. Base64 makes bytes transportable, not secret.
- How much larger does the output get?
- About 33%. Every three bytes become four characters, and the result is padded up to a multiple of four.
More tools
One of 18 free tools here. They come out of building utility apps for macOS, iOS and the browser — all of it by one person.
See the apps