Base64 Encoder & Decoder

Base64 is not encryption

This is the most important thing to know. Base64 is a fully reversible encoding. It keeps no secrets.

Wrapping a password or API key in Base64 provides no security whatsoever — any tool recovers the original in a second. Breach reports regularly turn up systems that claimed to "encrypt" credentials when they had merely Base64-encoded them.

If you need secrecy, use real encryption such as AES. If you need a one-way transformation, use a hash.

So what is Base64 for?

Carrying binary data through channels that only accept text.

Email (SMTP), JSON, XML, and URLs were all designed around text. Dropping raw bytes from an image or executable into them breaks on control characters.

Base64 turns every 3 bytes into 4 safe characters, which solves that — at the cost of making the data roughly 33% larger.

Typical uses:

• Email attachments — MIME encoding
• Data URIs — embedding images directly in HTML or CSS (data:image/png;base64,...)
• HTTP Basic authentication — username:password in Base64 (which is exactly why HTTPS is mandatory there)
• JWT — header and payload segments
• Binary payloads in JSON APIs

Why non-ASCII text breaks

The browser's built-in btoa() handles single-byte characters only. Feed it Korean, Japanese, or emoji and it throws or produces garbage.

The correct approach is to encode to UTF-8 first, then Base64. This tool does exactly that, so Korean, emoji, Japanese, and Chinese all round-trip correctly.

If Base64 produced elsewhere comes back mangled, the other side most likely skipped the UTF-8 step.

URL-safe Base64

Standard Base64 uses + and /. Both have special meaning in a URL: + may be read as a space and / is a path separator.

So URLs use a URL-safe variant:

| Standard | URL-safe | |---|---| | + | - | | / | _ | | = padding | dropped |

JWT and OAuth tokens use this variant. The two forms are not interchangeable, so the decoder has to match. This tool detects - or _ and decodes as URL-safe automatically.

What is the trailing =?

Padding. Base64 packs 3 bytes into 4 characters. When the input length is not a multiple of 3, the remainder is padded with = so the output length stays a multiple of 4.

• Input length divisible by 3 → no padding
• 1 byte remaining → ==
• 2 bytes remaining → =

Most decoders can work it out from the length even without padding, and the URL-safe variant drops it entirely.

Data URIs

Embedding a small icon directly in HTML:

<img src="data:image/png;base64,iVBORw0KGgo...">

This saves one HTTP request, which helps for very small images. But the data grows 33% and cannot be cached separately by the browser, so for anything more than a few kilobytes it is a net loss.

Related tools

To inspect a token's contents, the JWT decoder is easier. For a one-way transformation, use the hash generator; to tidy up JSON, use the JSON formatter.