Base64 Encode / Decode

What is Base64?

Base64 is a way of representing any data, text or binary, using only 64 safe characters: A–Z, a–z, 0–9, + and /, with = for padding. It exists because many systems were designed to carry plain text only. Email attachments, data URIs in HTML and CSS, HTTP Basic authentication headers, JSON Web Tokens and many APIs all use Base64 to move bytes safely through text-only channels.

Base64 is an encoding, not encryption. Anyone can decode it, so never use it to hide passwords or secrets. It also makes data about 33% larger, because every three bytes become four characters.

How to use it

1. Choose Encode to turn text into Base64, or Decode to turn Base64 back into text.
2. Type or paste into the input box. The output updates instantly.
3. Tick URL-safe to use - and _ instead of + and / and drop the padding, as used in JWTs and URLs.
4. Click Swap to feed the output back in the other direction, or copy the result.

How encoding works

Text is first converted to bytes using UTF-8, so accented letters, non-Latin scripts and emoji are handled correctly. The bytes are then read in groups of three (24 bits) and split into four 6-bit values, each mapped to one of the 64 characters. If the input does not divide evenly into groups of three, one or two = signs pad the end.

When decoding, this tool accepts both the standard and URL-safe alphabets, ignores spaces and line breaks, adds missing padding automatically, and tells you if the decoded bytes are not valid text, which usually means the data is an image or other binary file.

Examples

• Hello, World! encodes to SGVsbG8sIFdvcmxkIQ==.
• héllo ✓ encodes to aMOpbGxvIOKckw== (the accented letter and tick take several bytes in UTF-8).
• The URL-safe form of ??>> is Pz8-Pg instead of Pz8+Pg==.

More worked examples

Basic auth header: the credentials user:pass encode to dXNlcjpwYXNz, which is why Basic authentication must always run over HTTPS.

Common mistakes to avoid

• Treating Base64 as encryption. Anyone can decode it instantly.
• Mixing standard and URL-safe alphabets. JWTs use - and _ without padding; tick URL-safe for those.
• Encoding images as text. Use the image to Base64 tool, which reads the file directly.

Sources and methodology

The calculations on this page follow these published standards and references. The code is covered by automated tests against known values.

• RFC 4648 – The Base16, Base32, and Base64 Data Encodings