Skip to content
Advertisement

Base64 Encode / Decode

Encode and decode Base64 for text and files, with URL-safe support.

Converter Text

Direction
Source

Settings

How Base64 Encode / Decode works

Base64 maps arbitrary binary data onto 64 printable ASCII characters so it can travel through channels that only handle text. Three bytes — 24 bits — are regrouped into four 6-bit values, and each value indexes the alphabet A–Z, a–z, 0–9, plus + and /.

When the input length is not a multiple of three, the final group is padded with zero bits and the output is padded with = characters to keep the length a multiple of four. One leftover byte produces two characters and two padding marks; two leftover bytes produce three characters and one.

The cost is size. Every three bytes become four characters, so encoded data is about 33% larger than the original, before any line breaks that MIME-style encoders insert. That overhead is why Base64 is right for small payloads embedded in text and wrong for bulk file transfer.

The URL-safe variant (RFC 4648 §5) swaps + for - and / for _ so the result survives being placed in a URL path or query string without percent-encoding, and usually drops the = padding, which has its own meaning in query strings. JWTs, WebAuthn, and most modern web APIs use this variant.

Reference

  • Encoded length = 4 × ceil(n / 3) characters for n input bytes
  • Size overhead ≈ 33% (plus line breaks, if any)
  • Standard alphabet: A–Z a–z 0–9 + / with = padding
  • URL-safe alphabet: A–Z a–z 0–9 - _ padding usually omitted
  • Data URL form: data:<mime-type>;base64,<encoded>

How to use this tool

  1. Choose a direction

    Encode turns text or a file into Base64; decode turns Base64 back into the original bytes.

  2. Provide the input

    Type or paste text, or drop a file to encode its raw bytes — useful for producing data URLs.

  3. Pick the alphabet

    Use standard Base64 for email, config files, and general transport. Use URL-safe when the value goes into a URL or a JWT.

  4. Copy or download

    Copy the encoded string, or download the decoded bytes as a file when you are recovering an attachment.

Worked examples

Padding in practice

Given
The three inputs "M", "Ma", and "Man"
Result
"TQ==", "TWE=", "TWFu"

One, two, and zero padding characters. The padding count tells the decoder how many bits of the final group to discard.

A Basic Auth header

Given
alice:s3cr3t
Result
YWxpY2U6czNjcjN0

HTTP Basic Auth is Base64, not encryption. Anyone who captures the header recovers the password instantly — it only works safely over TLS.

Inlining a small icon

Given
A 1.2 KB PNG dropped onto the file input
Result
data:image/png;base64,iVBORw0KGgo… (~1.6 KB)

The 33% growth is worth avoiding an extra HTTP request for a tiny asset, and counterproductive for anything large.

When to use it

  • Embedding small images or fonts directly in CSS or HTML as data URLs.
  • Decoding a JWT segment or an OAuth state parameter by hand while debugging.
  • Reading an email attachment out of a raw MIME message.
  • Putting binary values — certificates, keys, small blobs — into JSON or YAML config files.
  • Constructing or inspecting HTTP Basic Authorization headers during API work.

Things to watch out for

  • Base64 is an encoding, not encryption or hashing. It is fully reversible by anyone, offers zero confidentiality, and is not obfuscation worth relying on.
  • Decoding fails on the wrong alphabet: a URL-safe string containing - or _ is invalid standard Base64, and vice versa.
  • Whitespace and line breaks are common in Base64 from emails and PEM files. Most decoders tolerate them, but a strict one will not.
  • Encoding text requires deciding on a character encoding first. This tool uses UTF-8, which is what you want in essentially every modern context.

Frequently asked questions

Is Base64 encryption?

No. It is a reversible encoding with no key, designed to move binary data through text-only channels. Anyone can decode it instantly, so it provides no confidentiality whatsoever.

What are the = characters at the end?

Padding. Base64 works on three-byte groups producing four characters; when the input does not divide evenly, = marks how many bits in the last group are filler. One = means one leftover byte was two; two = means it was one.

When should I use the URL-safe variant?

Whenever the value goes into a URL path, query string, or filename. Standard Base64 uses + and /, which have reserved meanings in URLs and would otherwise need percent-encoding. JWTs and WebAuthn use URL-safe throughout.

Why is my decoded text garbled?

Usually a character-encoding mismatch — the bytes were encoded as UTF-16 or a legacy code page and are being decoded as UTF-8. It can also mean the input was truncated or is using the other alphabet variant.

How much larger does Base64 make my data?

About 33%: every three bytes become four characters, plus padding and any line breaks. That is acceptable for a small inline asset and wasteful for large files.

Are my files uploaded when I drop them here?

No. Files are read with the browser’s FileReader API and encoded locally. Nothing is transmitted, so encoding a certificate or a private key is safe.

Related Developers tools

All developer tools