How to use the Base64 tool
- Choose Encode or Decode.
- Type or paste your text, or Base64 to decode. To encode a file, choose it or drop it on the box.
- For encoding, pick options: URL-safe alphabet, no padding, or 76-character lines.
- Copy or download the result. Decoded binary data has its own download button.
Decoding is tolerant: spaces and line breaks are ignored, padding is optional, and the standard and URL-safe alphabets are both accepted and detected.
How Base64 works
Base64 takes the input bytes three at a time (24 bits) and splits them into four groups of 6 bits. Each 6-bit number (0–63) maps to a character: A–Z, a–z, 0–9, then + and /. When the input length isn’t a multiple of three, the last group is padded with =.
Text has to be turned into bytes first. This tool uses UTF-8, the encoding of almost every website. That’s why it handles “Grüße”, “¡Hola!” and “Привет” correctly, where the browser’s built-in btoa() fails on any character above U+00FF.
Worked examples
Example 1: text with accents and emoji
Encode the sample sentence. Decode the result again and you get the identical text, including the emoji. Each non-ASCII character takes 2–4 UTF-8 bytes, so the Base64 is longer than for plain English.
Example 2: HTTP Basic authentication header
Authorization: Basic headers carry username:password in Base64. Encoding user:pass gives dXNlcjpwYXNz. This shows why Basic auth must only be used over HTTPS: the password can be decoded by anyone who sees the header.
Example 3: a JWT segment
Paste the middle part of a JSON Web Token and decode it. The URL-safe alphabet and missing padding are detected automatically, and the JSON payload appears. For full token inspection, use the JWT decoder.
When to use Base64
- Embedding small files in JSON, XML or HTML (images as data URIs, certificates in config).
- Email attachments (MIME uses 76-character lines).
- Binary data in URLs or cookies, with the URL-safe alphabet.
Avoid it for large files over the network: the 33% overhead adds up, and binary uploads are more efficient.
Common mistakes
- Treating Base64 as security. It hides nothing. Encrypt sensitive data instead.
- Mixing alphabets. A server expecting standard Base64 may reject
-and_. - Double encoding. Encoding an already-encoded string produces valid but useless output; decode once to check.
- Wrong text encoding. Data encoded from Latin-1 text decodes to garbled characters as UTF-8.