Quick answer: Base64 Encoder Decoder is a free online base64 encode decode: encode any text to Base64 or decode Base64 back to text — with full UTF-8 support, optional URL-safe output, and everything processed locally in your browser. Free with no signup or download: get results instantly, all inside your browser.
Encode any text to Base64 or decode Base64 back to text — with full UTF-8 support, optional URL-safe output, and everything processed locally in your browser.
What is the Base64 Encoder Decoder?
Base64 encode decode converts between plain text and Base64, the widely used encoding that represents binary data with 64 safe ASCII characters (A–Z, a–z, 0–9, +, /). Because the output contains only printable characters, Base64 is the standard way to embed images in data URLs, attach files in JSON payloads, and transmit credentials in HTTP Basic authentication headers.
Many online Base64 tools only handle Latin-1 text and corrupt anything beyond basic English. This one encodes with proper UTF-8 support, so accented characters, CJK text, Arabic, and emoji round-trip perfectly. Toggle Encode to convert text to Base64, or Decode to convert Base64 back to readable text, with clear error messages if the input is malformed.
An optional URL-safe (Base64URL) mode swaps + and / for – and _ and drops padding, producing output that is safe inside URLs, filenames, and query strings — the same variant used in JWT tokens. All conversion happens in your browser; nothing is uploaded, which matters when you are encoding tokens or credentials.
Developers also reach for Base64 when debugging. API gateways log request bodies with binary fields encoded, mobile crash reports embed encoded data, and CI pipelines pass encoded secrets between steps. Decoding those blobs here — locally, with no upload — is often the fastest way to see what actually crossed the wire.
How to use the Base64 Encoder Decoder
Choose Encode to convert text into Base64, or Decode to convert Base64 back into text.
Paste or type your input into the box. Any language or emoji works thanks to UTF-8 handling.
Enable URL-safe output if you need Base64URL (for JWTs, URLs, or filenames).
Run the conversion and copy the result, or download it as a text file.
If decoding fails, check for missing padding (=) or characters outside the Base64 alphabet.
Base64 Encoder Decoder use cases
Embedding images as data URLs
Encode a small image to Base64 and inline it as data:image/png;base64,… in HTML or CSS. This removes an HTTP request for tiny icons and is a staple technique for email templates and single-file pages.
Inspecting JWT tokens
JSON Web Tokens are three Base64URL segments joined by dots. Decode the first two segments here to read the header and payload claims (or use our dedicated JWT Decoder for a nicer view).
Debugging Basic Auth headers
HTTP Basic authentication sends username:password as Base64 in the Authorization header. Decode a captured header to verify which credentials a client actually sent.
Storing binary in JSON
JSON cannot hold raw bytes, so APIs commonly Base64-encode file uploads, keys, and blobs. Encode or decode those fields here when inspecting payloads or writing test fixtures.
Tips
Base64 is an encoding, not encryption — anyone can decode it. Never treat Base64 output as secret.
If decoded text shows � replacement characters, the original was probably encoded as Latin-1, not UTF-8.
Use URL-safe mode when the output goes into a URL, cookie, or filename to avoid + and / breaking things.
Decoding ignores whitespace, so you can paste Base64 copied from formatted documents directly.
Frequently asked questions
Is Base64 encryption?
No — Base64 is a reversible encoding that anyone can decode; it provides zero confidentiality. It exists to represent binary data as safe ASCII text, not to hide it. Never encode passwords or secrets in Base64 and consider them protected. Treating Base64 as encryption is one of the most common security mistakes in software. If data needs secrecy, use real encryption like AES — encoding is not encryption.
Why do some Base64 strings end with = signs?
The = characters are padding marking how many bytes were missing from the final 3-byte group. URL-safe Base64URL mode typically drops the padding. When decoding, missing padding is usually tolerated — but for strict systems, keep the padding intact when encoding. The padding math: output length is always a multiple of 4, with one or two = signs filling the final quantum. Strict decoders reject unpadded input.
Does this tool support Unicode and emoji?
Yes — text is encoded as UTF-8 before conversion, so every Unicode script round-trips correctly. Accented characters, Chinese, Arabic, and emoji all survive intact — unlike older tools that only support Latin-1 and silently corrupt non-Latin text. This UTF-8 handling is what separates correct tools from legacy ones. Many old implementations assumed Latin-1 and mangled everything else — this one does not.
What is the difference between Base64 and Base64URL?
Standard Base64 uses + and /, which have special meaning in URLs; Base64URL replaces them with - and _. Base64URL also usually omits padding. Enable the URL-safe option whenever the output goes into a query string, a JWT, or a filename. JWTs use Base64URL for all three segments, which is why tokens are URL-safe by design. The toggle here mirrors that exact variant.
Why does decoding fail with an ‘invalid character’ error?
The input contains characters outside the Base64 alphabet, has incorrect padding, or is truncated. Check for stray spaces, line breaks from email clients, or missing = padding. Pasted text from PDFs or chat apps is the usual culprit — clean the suspicious characters and try again. When copying from email, watch for soft line breaks the client inserted — they are invisible but fatal to decoding.
Is my input uploaded anywhere?
No — encoding and decoding run entirely in your browser. This matters because people often decode tokens and credentials while debugging. That data never leaves your device here — the page can even be saved and used offline. Developers routinely paste live API keys here while debugging; the local-only design means those secrets are never at risk in transit. Debug with total peace of mind.
How large an input can it handle?
Typical use — tokens, headers, small text payloads — is instant. Very large inputs (tens of megabytes) still work but may take a moment since the whole string is processed in memory. For real-scale file conversions, a local command-line tool is more comfortable. Base64 inflates data by about 33%, so very large inputs produce proportionally large outputs — another reason the command line suits bulk jobs.
How do I know if a string is Base64?
Base64 uses only A–Z, a–z, 0–9, + and / (or - and _ in URL-safe mode), and its length is always a multiple of 4. Strings that end with = padding are especially recognizable. If a token has three dot-separated segments, it is probably a JWT — try the JWT Decoder for a structured view instead. Learning to spot the alphabet at a glance speeds up debugging considerably.