Base64 Encode / Decode

How to use the Base64 Encode / Decode

1. 1

   Choose Text mode for strings or File mode for images, PDFs and other files.

2. 2

   In Text mode, select Encode or Decode and paste your input. The result appears instantly on the right.

3. 3

   Tick URL-safe if the output will go into a URL, a filename or a JWT.

4. 4

   In File mode, drop a file to get its Base64 and data URI, or paste Base64 in the lower box to preview and download the original file.

5. 5

   Copy the result, or use Swap to feed the output back in and check that it decodes correctly.

What Base64 really does

Base64 is a way of writing any binary data using only 64 safe, printable characters: A to Z, a to z, 0 to 9, plus + and /. It takes the data three bytes at a time, splits those 24 bits into four groups of six bits, and maps each group to one of the 64 characters. The word Man, three bytes, becomes TWFu, four characters.

When the input length is not a multiple of three, the output is padded with = so its length stays a multiple of four. That is why Hi encodes to SGk= and a single emoji like 🙏, which is four bytes in UTF-8, encodes to 8J+Zjw==.

The purpose is transport, not secrecy. Many older systems, such as email and some text-only APIs, were built for plain text and can corrupt raw bytes. Base64 lets you squeeze an image or a PDF through those channels without damage.

Base64 is not encryption

This is the most important point on the page. Base64 has no key and no secret. Anyone can paste a Base64 string into this tool, or any other, and read the original in a second. Encoding a password in Base64 before storing it in a config file protects it from nobody.

Kubernetes secrets, HTTP Basic authentication headers and many API tokens look scrambled because they are Base64, not because they are protected. If you need to keep data private, use real encryption such as AES, and store passwords with a proper password hash like bcrypt or Argon2.

Where you will run into Base64

• Data URIs: small images and fonts embedded directly in HTML or CSS, written as data:image/png;base64, followed by the encoded bytes. File mode produces this string ready to paste into an img src.
• Email attachments: MIME email encodes attachments in Base64, which is why a 3 MB photo makes the email about 4 MB.
• HTTP Basic auth: the header Authorization: Basic YWRtaW46c2VjcmV0 is just admin:secret in Base64, which is why Basic auth must only be used over HTTPS.
• JWT tokens: the header and payload of a JSON Web Token are Base64url encoded. Paste the middle part of a JWT into the decoder to read its claims. The signature proves it was not tampered with, but the contents are readable by anyone.
• APIs that accept files as JSON fields, such as OCR, e-sign and document upload services, which often ask for the file as a Base64 string.

UTF-8, Hindi and emoji

The browser's built-in btoa function only understands characters with codes up to 255. Feed it नमस्ते and it throws an error, which is why many quick Base64 snippets on the internet break on Indian languages. This tool first converts text to UTF-8 bytes with TextEncoder, then encodes those bytes. Decoding reverses the steps with TextDecoder.

So नमस्ते, six characters on screen but eighteen bytes in UTF-8, becomes 4KSo4KSu4KS44KWN4KSk4KWH, and decodes back exactly. If you decode Base64 that was made from a file rather than text, the bytes will not be valid UTF-8. Instead of showing garbled symbols, the tool tells you so and suggests File mode, where you can download or preview it.

Standard vs URL-safe Base64

Two of the standard characters cause trouble in web addresses: + can be read as a space, and / looks like a path separator. The URL-safe alphabet, defined alongside the standard one in RFC 4648, swaps them for - and _. The = padding is usually dropped too, since = has a meaning in query strings.

When decoding you do not have to choose. The tool recognises both alphabets, adds missing padding and ignores line breaks, so you can paste the wrapped Base64 you often see in emails and certificates.

Size overhead and common decode errors

Because every three bytes become four characters, Base64 output is about 33% larger than the original, slightly more with padding or line breaks. The size panel shows the exact numbers. That overhead is why embedding a 500 KB photo as a data URI is a bad idea: it bloats your HTML and cannot be cached separately. Keep data URIs for small icons.

If decoding fails, the error usually tells you why. A character like $ or a space in the middle means the text is not Base64 at all. A length error almost always means the string was cut off while copying, often by a chat app or a terminal that truncated a long line. A mix of + and - in one string suggests two different encodings were joined together.