What is Base64 encoding?

Base64 is an encoding scheme that converts binary data into a text-safe format using 64 characters (A–Z, a–z, 0–9, +, /). It's not encryption - it's encoding, meaning anyone can decode it. The output is typically about 33% larger than the original.

Base64 is used to safely transmit binary data over text-only channels. Common uses: encoding images as data URIs in CSS, encoding binary data in JSON APIs, email attachments (MIME encoding), embedding fonts in HTML, and encoding credentials in Basic Auth headers.

Is Base64 the same as encryption?

No. Base64 is encoding, not encryption. Anyone with a Base64 decoder can read the original content. Never use Base64 to "hide" sensitive information. For security, use actual encryption (AES, RSA, etc.).

What does the "=" padding at the end mean?

Base64 works in groups of 3 bytes → 4 characters. If the input length isn't a multiple of 3, padding ("=") is added to make the output length a multiple of 4. One "=" means 1 padding byte was added; "==" means 2.

Can it encode binary files?

This tool works with text input. For binary files (images, PDFs), you'd need a file-based Base64 tool. The text encoder handles Unicode text by first UTF-8 encoding it before Base64 encoding.

Is my text stored anywhere?

No. All encoding/decoding happens in your browser. Your text never reaches any server.

Base64 Encoder / Decoder

Encode and decode Base64 strings online. Free Base64 encoder/decoder - supports text, URLs, and data URIs. No signup.

🔒 Your text stays in your browser - nothing is sent to our servers

Text Input

Base64 Output

How to Use

Three steps to get started

Choose direction

Select "Text → Base64" to encode or "Base64 → Text" to decode.

Paste your content

Enter the text or Base64 string you want to convert.

Copy the result

Click Copy and use the encoded/decoded result in your project.

About This Tool

Base64 encoding and decoding explained

Base64 is a binary-to-text encoding, standardized in RFC 4648, that represents arbitrary bytes using only 64 printable ASCII characters: A–Z, a–z, 0–9, +, and /, with = as padding. It exists because many protocols were built for text and will mangle raw bytes - an email gateway that strips the eighth bit or a JSON parser that chokes on a null byte. Base64 makes the data survive the trip.

The mechanism is simple arithmetic: take three bytes (24 bits), slice them into four 6-bit groups, and map each group to one character. Three bytes in, four characters out - which is why Base64 output is always about 33% larger than the input. Encoding Man gives TWFu; encoding Ma leaves a partial group, so the result is padded to TWE=.

Where you will run into it in production:

Data URIs - data:image/png;base64,iVBORw0KGgo… inlines an image or font directly into HTML or CSS, trading size for one fewer request
HTTP Basic Auth - the Authorization header carries base64(username:password), which is why Basic Auth is only safe over TLS
JWTs - the header and payload segments are Base64url-encoded JSON, so any token can be read without the signing key
MIME email - attachments are Base64-encoded with line breaks every 76 characters
Kubernetes Secrets - values in a Secret manifest are Base64, a fact that regularly gets mistaken for encryption
Binary blobs in JSON - thumbnails, certificates, and PDFs squeezed into a text-only API field

Standard Base64 vs Base64url

There are two alphabets in common use, and mixing them up is the classic cause of an "invalid Base64" error. Standard Base64 uses + and /, both of which have meaning inside URLs. Base64url (also RFC 4648) substitutes - and _ and usually drops the = padding entirely, which is what JWTs and OAuth parameters use. If a token refuses to decode, try swapping -_ back to +/ and re-adding padding until the length is a multiple of four.

The point worth repeating: Base64 is encoding, not encryption. There is no key and no secret - anyone can reverse it instantly. Storing a password, API key, or personal data as Base64 gives you obfuscation at best, and auditors treat it as plaintext. Use AES or a proper secret manager when confidentiality actually matters.

This tool encodes Unicode correctly by converting text to UTF-8 bytes first, so emoji, accented letters, CJK characters, and right-to-left scripts round-trip cleanly rather than throwing the range errors a naive btoa() call produces. Encoding and decoding both execute locally in your browser, so tokens and payloads you are debugging never leave the machine.

FAQ

Frequently Asked Questions

Related Tools