Base64 Encoder / Decoder
Paste on one side, read the result on the other. Encoding and decoding happen as you type, with proper Unicode handling and errors written in plain English.
Converts as you type. Unicode is handled properly, so emoji and accented characters survive the round trip.
What Base64 is actually for
Base64 rewrites arbitrary bytes using 64 safe characters so they can travel through systems that only expect text: email bodies, JSON fields, data URLs, JWT payloads and config files. It is an encoding, not encryption, and that distinction matters more than anything else on this page.
Expect the output to be about a third larger than the input, since every three bytes become four characters. Trailing equals signs are padding that rounds the output up to a multiple of four, and you will see one or two of them but never three.
Where you will run into it
| Where | What it is doing there |
|---|---|
| Data URLs | Embeds an image or font directly inside HTML or CSS, saving a request |
| JWT tokens | The header and payload are Base64, separated by dots |
| Email attachments | MIME wraps binary files so old mail servers pass them through intact |
| HTTP Basic auth | Sends username and password as one Base64 string |
| Config files | Certificates and keys stored where only text is allowed |
It is not encryption
This is the mistake worth spelling out. The Base64 alphabet is public and the transformation is reversible by anyone, including by this page in the time it takes to paste. It hides nothing at all.
So if you find credentials sitting in a config file as Base64, treat them as stored in plain text with an extra step, and treat them as leaked if that file went anywhere it should not have. The same applies to JWTs: the header and payload of a token are readable by anyone holding it. The signature only proves the token was not altered, it does not keep the contents secret.
The URL-safe variant
Standard Base64 uses + and /, both of which mean something
else inside a URL or a filename. The URL-safe variant swaps them for - and
_ and usually drops the padding. Decoding here accepts either, and tolerates
missing padding and stray line breaks, which covers most tokens you will meet in the
wild.
Does this work with emoji and accented characters?
Yes. Text is converted to UTF-8 bytes before encoding, so anything you can type survives the round trip intact, including emoji and every accented letter.
Why does my decode say the result is not valid UTF-8?
The Base64 was fine, but the bytes underneath are not text, usually an image, an archive or encrypted data. This tool only displays text results, so it tells you rather than showing you a screen of nonsense.
Is my input uploaded anywhere?
No. The conversion runs in your browser, so pasted tokens and payloads never leave your device. That is the main reason to use a page like this one rather than a server-side converter.
Why does the output end in equals signs?
Padding. Base64 works in blocks of three input bytes, and when the last block is short it is filled out so the output length stays a multiple of four. You will see one or two, never three.
Can I encode an image or a file?
Not with this tool, which works on text. Turning a file into Base64 means reading its bytes first, which browsers do through a file picker rather than a paste box.
Is Base64 the same as encryption or hashing?
No, and confusing them is a common and expensive mistake. Encoding is reversible by design, encryption needs a key to reverse, and hashing cannot be reversed at all. Base64 is the first of those, so never use it to protect anything.