←Back to all tools

Base64 Encoder & Decoder

Paste on the left, read the result on the right. Full UTF-8 support, and switching direction keeps what you typed.

Your text
Here you go0 chars
Base64 turns arbitrary bytes into 64 safe printable characters so they can travel through systems that only expect text. It is an encoding, not encryption.
How to use it
  1. 1Pick encode or decode.
  2. 2Paste your text or Base64 string on the left.
  3. 3Copy the result on the right, switching direction keeps your input.
How Base64 works
Base64 takes three bytes of input (24 bits) and re-slices them into four six-bit groups, mapping each group to one character from A–Z, a–z, 0–9, + and /. Because it turns three bytes into four characters, encoded output is always about 33% larger than the input. When the input length isn't divisible by three, one or two = characters are appended as padding.
That size overhead is why you shouldn't Base64 everything. Inlining a small icon as a data URI saves a request and is usually worth it; inlining a 400KB photograph inflates it to over 530KB of uncacheable markup and is almost always a mistake.
Where you'll actually meet it
Data URIs in CSS and HTML, email attachments via MIME, JSON Web Token headers and payloads, HTTP Basic Authentication headers, API keys in configuration files, and binary blobs stuffed into JSON, all Base64. Anywhere a protocol expects text but the data is binary, this is the usual bridge.
You'll also see Base64URL, a variant that swaps + and / for - and _ and drops the padding, so the string survives being placed in a URL or filename. JWTs use it. A standard decoder will often reject a Base64URL string until you convert those characters back.
Base64 is not security
This is worth stating plainly, because it causes real breaches. Base64 is trivially reversible by anyone, with no key and no effort. A password, token or API secret that has been Base64-encoded is exactly as exposed as one written in plain text. HTTP Basic Auth credentials are Base64 for transport convenience only, the protection comes entirely from TLS.
If you need confidentiality, encrypt. If you need integrity, sign. If you just need to move bytes through a text channel, Base64 is the right tool.
Unicode and the common gotcha
The browser's built-in btoa function only accepts characters in the Latin-1 range, so it throws an InvalidCharacterError on emoji, accented characters and non-Latin scripts. The fix is to convert the string to UTF-8 bytes first, which is what this tool does, so "café", "日本語" and "🎉" all encode and round-trip correctly.
Common questions
Is Base64 encryption?
No. It's a reversible encoding with no key. Anyone can decode it instantly, so never use it to protect passwords, tokens or personal data.
Why does my Base64 string end in one or two equals signs?
That's padding. Base64 works in blocks of three input bytes; when the last block is short, = characters pad the output to a multiple of four. It carries no data.
Why did my emoji fail to encode elsewhere but work here?
Naive implementations pass the raw string to btoa, which only handles Latin-1. This tool converts to UTF-8 bytes first, so any Unicode character encodes and decodes cleanly.
How much larger does Base64 make my data?
Roughly 33%, plus up to two padding characters. Factor that in before inlining assets into CSS or JSON.
What's the difference between Base64 and Base64URL?
Base64URL replaces + with - and / with _, and usually omits padding, so the result is safe inside URLs and filenames. It's the variant used by JSON Web Tokens.