Base64 is a way to represent any data as plain ASCII text, so it can travel safely through channels that only understand text. The tool above encodes text to Base64 or decodes Base64 back to text, handles UTF-8 correctly so emoji and accents survive intact, and offers a URL-safe variant. Everything runs in your browser, and nothing you paste is transmitted anywhere.
What is Base64?
Base64 is a binary-to-text encoding scheme. It takes arbitrary bytes and represents them using a fixed set of 64 printable characters: the letters A to Z and a to z, the digits 0 to 9, and two symbols. Every three bytes of input (24 bits) are split into four 6-bit groups, and each group maps to one of those 64 characters. When the input length is not a multiple of three, one or two = characters are appended as padding.
The point is safe transport, not compression or secrecy. Many systems, such as email headers, URLs, and JSON fields, expect text and can mangle raw binary. Base64 turns that binary into a string those systems will carry unchanged.
Standard Base64 vs Base64url
Standard Base64 uses + and / as its last two characters and pads with =. Those characters have special meanings in URLs and filenames, so a second variant called base64url exists. It swaps + for - and / for _, and it usually drops the = padding entirely. This makes the output safe to place directly in a query string, a path segment, or a filename without extra escaping. JSON Web Tokens, for example, use base64url for every segment.
| Feature | Standard Base64 | Base64url |
|---|---|---|
| Character 62 | + |
- |
| Character 63 | / |
_ |
| Padding | = kept |
usually dropped |
| Safe in URLs | No, needs escaping | Yes |
When you tick the URL-safe option above, encoding produces base64url. Decoding always accepts either form, so you never have to guess which variant you were given.
Why UTF-8 handling matters
Base64 works on bytes, but text is not bytes until you choose an encoding. A common bug is to encode text one character at a time and assume each character is a single byte. That breaks the moment you hit an emoji, an accented letter, or any non-Latin script, because those characters are several bytes in UTF-8. This tool converts your text to UTF-8 bytes first, then encodes those bytes, and reverses the process on decode. The result is that café, €, and 🚀 all round-trip perfectly.
A worked example
Take the word Man. Its three bytes are 77, 97, 110. Written in binary that is 01001101 01100001 01101110. Regroup those 24 bits into four 6-bit chunks: 010011 010110 000101 101110, which are the numbers 19, 22, 5, and 46. Looking those up in the Base64 alphabet gives T, W, F, and u, so Man encodes to TWFu. Decode it here and you get Man back.
Common use cases
- Embedding small images or fonts directly in HTML or CSS as
data:URIs. - Reading or hand-checking the payload of a JSON Web Token, which stores base64url segments.
- Encoding binary attachments for email, which uses Base64 inside MIME.
- Passing structured or binary values through URL parameters using the URL-safe variant.
- Storing small blobs of data in text-only config files or environment variables.
Base64 is not encryption
This is the single most important thing to understand: Base64 provides no security whatsoever. It has no key and no secret. Anyone who sees a Base64 string can decode it back to the original in an instant, exactly as this tool does. Encoding is about format and transport; encryption is about confidentiality. If you need to protect a secret, use real encryption such as AES, and never treat a Base64 string as if it were hidden. Developers sometimes see an unreadable token and assume it is protected, but if it is only Base64, it is effectively in plain sight.
Common errors when decoding
- Invalid characters — pasting surrounding quotes, prose, or a partial copy introduces characters outside the alphabet. The status line names the offending character.
- Bad length — a Base64 string that has been truncated cannot be decoded; valid input is a whole number of 4-character groups once padding is accounted for.
- Missing padding — this is fine here. The decoder re-adds any padding that a URL-safe encoder stripped, so both padded and unpadded input work.
Privacy
Every conversion above happens locally with your browser’s native encoder and decoder. There is no server round-trip, no logging, and no third-party analytics on this page, so you can safely work with data you would not want to send elsewhere. As always with any online tool, use your judgement for the most sensitive values; because this runs entirely client-side, you can also load the page and then disconnect from the network to be certain.