Base64 Encoder & Decoder

How to use the Base64 tool

1. Stay on the Text tab to convert text. Type or paste on the left and the Base64 appears below; switch to Decode to go the other way. If you paste something that looks like Base64 while encoding, the tool offers to flip direction for you.
2. Turn on URL-safe alphabet for tokens that travel in a URL or a filename, and Drop padding to remove the trailing equals signs.
3. Turn on Wrap lines at 76 characters when the output goes into an email header or a PEM-style block.
4. Use the File → Base64 tab to drop any file and get both the raw Base64 and a ready-to-paste data: URI, with the size overhead shown.
5. Use the Base64 → File tab to paste Base64 or a data URI and download it as a real file. The type is detected automatically.

How Base64 works

Base64 reads the input three bytes at a time — 24 bits — and splits those bits into four groups of six. Each 6-bit group indexes a 64-character alphabet of A–Z, a–z, 0–9, + and /. Four printable characters therefore carry three bytes of arbitrary binary data.

When the input length is not a multiple of three, the last group is short. One leftover byte becomes two characters plus ==; two leftover bytes become three characters plus =. That is why encoded length is always 4 × ceil(n / 3) with padding.

These are the test vectors from RFC 4648, and this tool reproduces all of them.

Unicode, and why btoa is not enough

The browser’s built-in btoa takes a string and treats each character code as one byte. That works for plain ASCII and silently breaks for everything else: btoa('한') throws an InvalidCharacterError, and naive workarounds that mask the code point produce bytes that decode to the wrong character.

The correct pipeline is text → UTF-8 bytes → Base64. 한 is three UTF-8 bytes (EC 95 9C), which encode to 7ZWc. The party popper emoji is four bytes and encodes to 8J+OiQ==. This tool always goes through TextEncoder and TextDecoder, so Korean, Japanese, Arabic, accented Latin and emoji with skin-tone or flag modifiers all round-trip byte for byte.

Decoding is guarded in the other direction too: if the decoded bytes are not valid UTF-8, the tool says so instead of showing a wall of replacement characters, and points you at the file tab.

Worked examples

Basic auth header. Encoding demo:s3cret gives ZGVtbzpzM2NyZXQ=, which goes into an Authorization: Basic … header. Note that this is encoding, not protection — anyone can decode it, which is why Basic auth requires HTTPS.

JWT segment. A JWT header {"alg":"HS256","typ":"JWT"} encodes, with the URL-safe alphabet and padding dropped, to eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9. Turn on both options to reproduce it exactly.

Inline image. A 12 KB PNG becomes roughly 16 KB of Base64 — 16,000 characters in your stylesheet or HTML. Inlining saves one HTTP request but costs 33% more bytes and cannot be cached separately, so it is worth it for tiny icons and rarely worth it above a few kilobytes.

Email attachment. MIME wraps Base64 at 76 characters. 300 bytes of input become 400 Base64 characters, and wrapping adds 5 newlines for a total of 405 — a detail that matters if you are computing exact message sizes.

Tips and common mistakes

• Base64 is not compression. It always grows the payload. Compress first, then encode, never the other way round.
• Base64 is not encryption. Anything encoded is one paste away from plaintext.
• Mind the alphabet. A + in a URL query string is read as a space by many servers, and a / breaks path segments. Use the URL-safe variant, or percent-encode the whole token.
• Strip whitespace before comparing. A wrapped Base64 blob and an unwrapped one decode identically but are different strings, so a naive equality check fails.
• Do not trust a data URI’s MIME type. It is just text supplied by whoever wrote the URI. This tool cross-checks it against the decoded file’s magic bytes.
• Watch memory with large files. The Base64 string lives in the tab alongside the file’s bytes, so a 100 MB file needs well over 200 MB of memory. The tool shows only the first 20,000 characters on screen, but Copy still gives you the whole thing.

Glossary

• Padding – the = characters that round the output up to a multiple of four.
• URL-safe (base64url) – the RFC 4648 §5 alphabet using - and _.
• Data URI – a data:<mime>;base64,<payload> string that embeds a file directly in HTML, CSS or JSON.
• Magic bytes – the first few bytes of a file that identify its format, such as %PDF or the PNG signature.

Privacy

Everything here happens inside your browser tab. Text is encoded with the JavaScript already loaded on the page, and dropped files are read with the File API — no upload request is made, no data is logged, and nothing is sent to a server. Closing the tab discards it all, which makes the tool safe for credentials, tokens and internal documents.

Last reviewed: September 21, 2026