Base64 Encoder / Decoder
Encode text to Base64 or decode Base64 to text.
Why use this tool
01Convert between plain text and Base64 directly in the browser.
Type or paste text on either side — the tool encodes plain text to Base64 and decodes Base64 back to text in a single live view. There's no separate encode/decode button; both directions are computed simultaneously as you type.
Switch between two modes: Standard Base64 (RFC 4648 alphabet with + and / and = padding) is what most APIs, HTTP Basic Auth, and email MIME use. URL-safe Base64url (RFC 4648 §5, with - and _ instead of + and /, padding stripped) is what JWTs, OAuth tokens, and URL parameters use. Picking the wrong mode is the #1 reason Base64 "breaks" — switch the toggle and your token will likely decode cleanly.
The tool detects whether your input looks like valid Base64 (proper alphabet, valid length) and decodes it automatically. If it can't decode, you'll see an explicit invalid-input status — useful when you suspect your token was corrupted, truncated, or pasted with extra whitespace.
Everything runs locally in your browser. Sensitive payloads — JWTs, API keys, HTTP Basic Auth strings, internal config — never leave your device. Pair this with our JWT Decoder when you need to inspect the claims inside a Base64url-encoded JWT, or with URL Encoder when chaining encodings for tokens placed inside URL parameters.
How to use
02Quick checks before you copy
03Confirm the input is the format you intended.
Scan the result before using it in a document, URL, config, or message.
Copy only the output you need.
Use Cases
JWTs are three Base64url-encoded segments joined by dots. Copy one segment, switch the mode toggle to URL-safe, and read the decoded JSON. For full JWT inspection (header + payload + signature verify), use the dedicated JWT Decoder.
Basic Auth sends a header like Authorization: Basic dXNlcjpwYXNz. The Base64 portion encodes username:password. Decode it (Standard mode) to verify what credentials your client actually sent — a fast way to find a missing trailing newline or wrong field ordering.
Some APIs require Basic Auth or a Base64-encoded shared secret in a header. Type your username:password (or your raw secret) into the input and copy the encoded output directly into your curl command, Postman header, or environment variable.
Email transports binary attachments as Base64. Paste the body content (between MIME boundary markers) to verify the encoded payload roundtrips correctly. For genuine binary content (images, PDFs), the decoded text will look garbled — that's expected; you'll need a binary viewer for the actual file.
When porting tokens between systems that use different alphabets (Standard vs URL-safe), encode in one mode, switch the toggle, and the same input is re-emitted in the other variant. Faster than hand-replacing + with - and / with _.
Spotted a long blob in a log file? Paste it in — the "likely Base64" indicator tells you whether it parses as valid Base64 (alphabet + length OK). If yes, the decoded view reveals what's inside; if no, the indicator says so explicitly so you don't chase a false lead.
Tips & Tricks
- 01Pick the correct alphabet
Use standard Base64 for MIME, Basic Auth, and most payloads. Use Base64url for JWTs and URL-safe tokens where +, /, and padding may break transport.
- 02Base64 grows the input by about 33%
Every 3 bytes become 4 Base64 characters. So a 1KB string becomes ~1.33KB encoded. For inline data URIs in CSS or HTML, only do this for very small assets (icons under 4KB) — larger assets save bandwidth as separate requests.
- 03Whitespace and line breaks are tolerated on decode
When you paste Base64 copied from terminals, emails, or PEM blocks (which fold at 64-76 chars per line), the tool ignores embedded whitespace. You don't need to clean up the input — it just works.
- 04Encoding is not encryption
Base64 makes bytes printable; it does not hide or protect secrets. Anyone can decode it without a key.
- 05URL-safe is JWT and OAuth territory
If you see a string with no padding and - / _ characters instead of + /, it's almost certainly Base64url. Common sources: JWT header/payload segments, OAuth state parameters, PKCE code challenges, and many JSON Web Key (JWK) fields.
FAQ
04Does this tool work entirely in my browser?
Yes. Encoding and decoding both use built-in browser APIs (btoa/atob plus a small UTF-8 wrapper). Nothing is uploaded — your input, including sensitive content like JWTs, API keys, or Basic Auth credentials, never leaves your device. No logging, no analytics on the content.
What's the difference between Standard Base64 and URL-safe Base64?
Standard Base64 (RFC 4648 §4) uses A-Z, a-z, 0-9, +, /, and = for padding. URL-safe Base64url (RFC 4648 §5) substitutes - for + and _ for / so the result is safe inside URLs without further encoding, and typically omits the = padding. JWTs, OAuth tokens, and many web standards use the URL-safe variant.
Can this tool encode files or images?
No. This tool is text-only. To convert an image or binary file to a Base64 data URI, paste a small script into your browser's DevTools console — for example: `const b = await file.arrayBuffer(); const s = btoa(String.fromCharCode(...new Uint8Array(b))); console.log('data:image/png;base64,' + s);` — or use a command-line tool like `base64 < file.png`. The text input here accepts UTF-8 text up to several MB but will not parse binary file content.
Why does my decoded Base64 look like garbled characters?
If the original encoded content was binary (an image, PDF, executable, or other non-text data), the decoded output cannot be displayed as readable text — you're seeing UTF-8 attempting to interpret raw bytes. This usually means the source isn't text to begin with, not that decoding failed. To recover the actual binary file, you'd need a binary-aware tool.
Why is my JWT failing to decode?
Two common reasons: (1) you pasted only part of the JWT — make sure you're decoding ONE segment at a time (split the token on the dots), not the whole thing. (2) JWTs use URL-safe Base64 — switch the mode toggle to URL-safe and try again. For full JWT inspection with signature verification, use our dedicated JWT Decoder.
Is Base64 a form of encryption or compression?
Neither. Base64 is an encoding — a deterministic, reversible mapping that lets binary data travel safely through text-only channels (JSON, XML, HTTP headers, email). It does not protect content from being read (encoding ≠ encryption) and it actually makes data larger, not smaller (encoding ≠ compression).
Why is the Base64 output longer than the input?
Base64 uses 6 bits per character to represent 8-bit binary, so every 3 input bytes produce 4 output characters — about a 33% increase. There's no way to avoid this overhead with Base64; if size matters and the channel allows binary, send the raw bytes instead.
What's a Base64 data URI?
A data URI embeds content directly in a URL using the syntax data:[mime-type];base64,<encoded>. Example: data:image/png;base64,iVBORw0KGgo... You can use this in CSS (background-image), HTML (img src), or anywhere a URL is expected. Best for tiny assets — larger ones bloat HTML/CSS files and hurt cache efficiency.
Can I decode a Base64 string that was copied with extra newlines?
Yes. The tool ignores whitespace inside the input — line breaks, spaces, and tabs are stripped before decoding. PEM-style content (which wraps at 64-76 chars per line) and shell-copied output paste cleanly.
Why does the "likely Base64" indicator say No on valid text?
The detector checks both the character set (only Base64 alphabet allowed, plus padding) and the length (a multiple of 4 for standard Base64). Plain English text usually contains characters outside the Base64 alphabet (spaces, punctuation, etc.) and so is correctly flagged as not-Base64. This is a feature — it prevents the decoder from trying to interpret arbitrary text as Base64 and producing nonsense.
Related tools
03Image to Data URL Generator→
Convert any image or file to a Base64 data URL — preview, CSS/HTML usage snippets, no upload.
JWT Decoder & Verifier→
Decode, build, and verify JWT tokens — entirely client-side (HS256).
URL Encoder & Decoder — Convert Text to URL-Safe Format→
Encode text for URLs or decode encoded URL values.