Base64 Encoder & Decoder

What Base64 actually does

Base64 takes arbitrary bytes and re-expresses them using 64 characters that survive any text-only channel: A–Z, a–z, 0–9, + and /. Three bytes of input (24 bits) become four output characters of 6 bits each. When the input length isn’t divisible by three, = pads the final group.

That 4:3 ratio is why Base64 output is always about 33% larger than the input. It’s the price of making binary data safe to paste into JSON, embed in a data URI, or send through an email header.

How to use this tool

1. Pick Encode to turn text into Base64, or Decode to go the other way.
2. Paste into the left pane — or drag a text file onto it.
3. The result appears immediately. Use Copy or Download to take it with you.

The swap button moves the output back into the input and flips the mode, which is handy for checking that a value round-trips cleanly.

Text encoding matters

Base64 encodes bytes, but you typed characters — so something has to turn one into the other first. This tool always uses UTF-8, matching browsers, JSON, and essentially every modern API.

This is the single most common source of “the same input gave me different output” confusion. The character é is code point U+00E9, but in UTF-8 it is two bytes, 0xC3 0xA9:

Input	Encoding used	Base64
é	UTF-8 (this tool)	w6k=
é	Latin-1	6Q==

Both are “correct” Base64 — they just encode different bytes. If your output doesn’t match another tool’s, check which encoding that tool assumed before assuming either is broken.

URL-safe Base64

+ and / both have reserved meanings inside URLs, so RFC 4648 §5 defines a variant that substitutes - and _ and typically drops the = padding. JSON Web Tokens use exactly this variant, which is why a JWT’s three segments contain no +, / or =.

Decoding here tolerates both alphabets and restores missing padding automatically, so you can usually paste a token segment straight in.

Base64 is not encryption

It’s worth stating plainly, because it’s a recurring source of real security incidents: Base64 provides no confidentiality whatsoever. There’s no key, and reversing it is a single function call. A password, API key or token stored as Base64 is stored in plaintext with an extra step.

Encoding solves a transport problem — getting bytes through a channel that only accepts text. Encryption solves a secrecy problem. They are unrelated.