Skip to content
Collabs Tool
DeveloperRuns in your browserPopular

Base64 Encoder / Decoder

Encode text to Base64 or decode it back, with URL-safe and UTF-8 options.

Input
No upload needed — instant
Privacy
Nothing is uploaded
Cost
Free · no sign-up · no watermark

Loading tool…

The tool is loading its code on your device. This happens once and is cached for later visits.

Processed entirely on your device

Everything you type or paste is handled by JavaScript running in this tab. No request is sent, nothing is logged and nothing is stored. Close the page and it is gone.

Overview

About the Base64 Encoder / Decoder

Free Base64 encoder and decoder for text and files. Handles UTF-8 correctly, supports URL-safe alphabets, and explains decode failures. Nothing is uploaded.

Base64 exists because a lot of the internet's plumbing was designed for text. Email bodies, HTTP headers, XML attributes, JSON strings, CSS values and URL query parameters all historically choked on arbitrary bytes. Base64 translates any byte sequence into 64 characters that every one of those channels handles safely.

The alphabet

The standard alphabet is A–Z, a–z, 0–9, + and /, with = as padding. Every six bits of input become one character, so three bytes become four characters.

The URL-safe alphabet replaces + with - and / with _. Both of the replaced characters are reserved in URLs: + means space in a query string, and / is a path separator. Padding is frequently dropped as well, and decoders are expected to tolerate its absence.

The UTF-8 trap

This is the single most common Base64 bug in JavaScript. atob() and btoa() operate on binary strings where each character code is one byte. If you pass a string containing é directly to btoa(), it throws or produces garbage, because é is code point 233 which is fine, but € is 8364 which is not representable in a single byte.

The correct round trip is:

  • Encode: TextEncoder → UTF-8 bytes → Base64 of those bytes.
  • Decode: Base64 → bytes → TextDecoder with UTF-8 → string.

This tool does both steps. If you are writing the code yourself, skipping either one produces mojibake that looks like é or €.

What Base64 is not

It is not encryption, not hashing and not compression. There is no key, no digest and the output is 33% larger than the input. Encoding secrets in Base64 before storing or transmitting them is a real and persistent security mistake — it obscures a value from casual observation while providing no actual protection.

Where you will meet it

  • Data URIs in HTML and CSS, embedding images and fonts inline.
  • JWT segments, base64url-encoded header and payload around a signature.
  • HTTP Basic auth, base64(username:password) — secure only because TLS wraps it.
  • MIME email attachments, the original use case.
  • Source maps, where VLQ-encoded Base64 segments describe position mappings.
  • Docker and Kubernetes configs, secrets stored base64-encoded — again, encoded, not encrypted.

Step by step

How to use the Base64 Encoder / Decoder

  1. Choose Encode or Decode, then paste your text or drop a file.

  2. For encoding, confirm UTF-8 handling if the text contains accents, emoji or non-Latin script.

  3. For decoding, select URL-safe mode if the string contains - or _ instead of + and /.

  4. Press Convert and read the result alongside its byte length.

  5. Copy the output, or download it as a text or binary file.

Why use it

Benefits and common use cases

What this tool is good for, and what it deliberately does not try to do.

Correct UTF-8 handling

Encodes through a proper UTF-8 byte conversion, so accented characters, CJK text and emoji round-trip instead of turning into mojibake — the classic atob() pitfall.

Standard and URL-safe alphabets

Switches between +/ and -_ alphabets and handles missing padding, which is what JWTs, S3 keys and most modern APIs actually use.

Binary as well as text

Encode a file's raw bytes and decode back to a downloadable binary, not just strings.

Explanatory errors

Invalid characters, bad padding and truncated payloads each produce a specific diagnosis instead of a generic failure.

Questions

Frequently asked questions

Short, honest answers about quality, limits and privacy.

Is Base64 a form of encryption?

No. Base64 is an encoding, not a cipher — it uses no key and is trivially reversible by anyone. Encoding a password or a token in Base64 provides zero confidentiality. Basic authentication's use of Base64 is frequently misunderstood for this exact reason; it relies entirely on TLS for security.

Why does Base64 make data 33% larger?

It maps every three bytes (24 bits) onto four printable characters (6 bits each). Four characters carry 32 bits of space for 24 bits of data, so the overhead is exactly 4/3 — about 33.3%, plus padding to reach a multiple of four.

What is URL-safe Base64?

Standard Base64 uses + and /, both of which have special meaning in URLs and query strings. The URL-safe variant substitutes - for + and _ for /, and often omits the = padding. JWTs, Google APIs and AWS use it widely.

Why does my decoded text look garbled?

Almost always a UTF-8 handling error. JavaScript's atob() returns a binary string where each character is one byte; multi-byte UTF-8 sequences must be reassembled through a Uint8Array and TextDecoder. This tool does that automatically. If the output is still wrong, the source may have been encoded from a different charset.

Can I decode a JWT with this?

You can decode the payload segment — the middle part between the dots — using URL-safe mode. That shows the claims. It does not verify the signature, and you should never treat an unverified JWT payload as trustworthy.