Base64 Encoder & Decoder
Convert text or files to Base64 and back, with proper UTF-8 handling and a URL-safe variant for tokens and query parameters.
Encode a file
About the Base64 Encoder & Decoder
Base64 is a way of writing binary data using only 64 printable ASCII characters. It exists because a lot of the internet's plumbing was built for text: email bodies, HTTP headers, JSON string values, XML documents and URLs all handle letters and digits reliably and mishandle raw bytes. Encoding binary data as Base64 lets it travel through those channels intact, at the cost of roughly 33% extra size.
You meet it constantly. HTTP Basic authentication sends username:password Base64-encoded in a header. JSON Web Tokens are three Base64url-encoded segments separated by dots. Email attachments are Base64 inside the message body. Data URIs embed images the same way. Configuration systems store certificates and keys as Base64 because a YAML file cannot hold raw bytes.
Two details trip people up, and this tool handles both. The first is UTF-8: the browser's native btoa function throws an error on any character above U+00FF, so encoding “café” or an emoji with it fails. This tool encodes the UTF-8 bytes properly. The second is the URL-safe variant, which replaces + and / with - and _ and usually drops the padding, because the standard alphabet breaks when placed in a URL or filename.
How to use it
- Choose a directionEncode plain text into Base64, or decode a Base64 string back into readable text.
- Paste your inputAny text in any language, including emoji and accented characters — UTF-8 is handled correctly in both directions.
- Pick the alphabetStandard Base64, or URL-safe Base64url for values that will appear in a URL, filename or JWT.
- Set paddingKeep or drop the trailing = characters. Most JWT and URL contexts omit them.
- Or encode a fileDrop any file in to get its Base64 representation, useful for certificates, keys and small binaries.
- Copy the resultOne click copies the output; invalid input is flagged with an explanation rather than a silent failure.
Features
- Full UTF-8 supportEncodes and decodes any Unicode text correctly, including emoji, where naive btoa implementations throw.
- URL-safe variantBase64url with - and _ substitutions, the alphabet used by JWTs and URL parameters.
- Optional paddingInclude or strip trailing = characters to match whatever your target system expects.
- File encodingEncode any file to Base64 locally — certificates, keys, images and small binaries.
- Clear error messagesInvalid Base64 is reported with the reason instead of an empty result or a cryptic exception.
- Byte countsInput and output lengths shown so you can see the 33% overhead concretely.
Who uses this tool
- API developersBuild Basic authentication headers and inspect the payload segment of a JSON Web Token.
- DevOps engineersEncode certificates and secrets for Kubernetes manifests, or decode a secret to check its contents.
- Email developersDecode a Base64 message body or attachment while debugging a delivery problem.
- Security learnersSee directly that Base64 is an encoding, not encryption, and understand why that distinction matters.
Tips worth knowing
- Base64 is not encryption. Anyone can decode it in one second. Never use it to protect a password, a key or anything else that matters.
- If a decoded string is unreadable, the input was probably binary rather than text — try decoding it in file mode instead.
- Base64 length is always a multiple of four once padding is included; a length that is not is a reliable sign of a truncated string.
Frequently asked questions
Is Base64 a form of encryption?
No. It is a reversible encoding with no key and no secret. Anyone who sees a Base64 string can decode it instantly. It exists to make binary data survive text-only transport, not to hide anything.
Why does encoding fail on emoji or accented characters elsewhere?
The browser's native btoa function only accepts characters in the Latin-1 range and throws on anything above U+00FF. This tool converts your text to UTF-8 bytes before encoding, so any Unicode character works in both directions.
What is URL-safe Base64?
A variant that replaces + with - and / with _, because those two characters have special meanings in URLs and are illegal in filenames on some systems. Padding is usually dropped too. JSON Web Tokens use this alphabet.
How much bigger does Base64 make my data?
About 33%. Every three bytes of input become four output characters. A 3 KB file encodes to roughly 4 KB of text, plus a couple of padding characters.
Can I decode a JWT here?
You can decode its parts. Split the token on the dots and decode the first two segments as URL-safe Base64 to read the header and payload. The third segment is a signature — raw bytes, not text — and cannot be verified without the signing key.
Is my input sent anywhere?
No. Encoding and decoding happen entirely in your browser, which is essential given how often Base64 strings contain credentials, tokens and private keys.