Free Base64 Encode and Decode
Where you run into Base64 in everyday development
Base64 turns up in more places than most developers expect, usually when something called a string needs to carry data that is not plain text. This tool encodes text to Base64 and decodes Base64 back to text, handles UTF-8 properly so Bengali, Arabic, emoji and accented letters survive the trip, and supports the URL-safe variant. It runs in your browser.
A few real examples
| Plain text | Base64 |
|---|---|
| Hello | SGVsbG8= |
| Hello, world! | SGVsbG8sIHdvcmxkIQ== |
| Aladdin:open sesame | QWxhZGRpbjpvcGVuIHNlc2FtZQ== |
The third is the classic example from the HTTP Basic authentication standard, where a username and password separated by a colon are sent in a header in this form. The equals signs at the end are padding, there to make the length a multiple of four.
Common places you meet it
- HTTP Basic authentication headers.
- JSON Web Tokens, whose first two parts are URL-safe Base64. The JWT decoder reads whole tokens for you.
- Email attachments, encoded behind the scenes.
- Data URIs that embed images in pages. See the image to Base64 converter.
- Configuration systems, such as secrets stored in Kubernetes, and some API keys.
How to use the tool
- Paste your text or Base64 string.
- Tick URL-safe if the result will go into a web address or a token.
- Click Encode or Decode.
- Copy the result, or use it as the new input to convert again.
Standard and URL-safe Base64
The standard alphabet includes the plus and slash characters, which have special meanings in web addresses. The URL-safe variant replaces them with a hyphen and an underscore and often drops the padding. JSON Web Tokens use this form. If you decode a token part with the standard method and it fails, the variant is usually the reason, so tick the URL-safe box.
Why decoding sometimes fails
- The string has spaces or line breaks inserted by an email or a chat app.
- The padding was removed, or an equals sign was lost when copying.
- It is the URL-safe variant but was decoded as standard.
- It encodes binary data, such as an image, so the text view shows meaningless symbols.
- It is not Base64 at all, just something that looks like it.
Base64 is not encryption
This is the most dangerous misunderstanding. Base64 hides nothing. Anyone can decode it in a moment, with this tool or with a line of code. It changes how data is written, not who can read it. Never use it to protect passwords, tokens or personal data. If a system stores secrets in Base64, they are effectively in the open. Note also that the result is about a third larger than the input, because every three bytes become four characters.
A practical walk-through
You receive a configuration value that reads dXNlcjpwYXNzd29yZA== and want to know what it is. Paste it into the tool and click Decode. The result is user:password, a username and password joined by a colon, which tells you immediately that it is probably a Basic authentication credential, and that it is sitting in the open. Now you know what to rotate. The reverse is just as quick: paste any text and click Encode to produce a string for a header or a test.
Encoding in code
Every language has built-in functions for Base64. In JavaScript, browsers provide a pair of functions for it, though they need care with non-Latin characters, which is why this tool handles UTF-8 for you. In Python, a standard module does the work. Use the tool to check your code’s output against a trusted result.
Size and performance
The encoded form is about a third larger than the original, so do not Base64 large files into text fields when you can avoid it. For uploads, normal file transfer is more efficient than embedding data in JSON.
Handling unfamiliar strings with care
If you decode a string from a source you do not trust, look at the result as text and do not run or open anything it contains. Decoded data can be a script, a link or a file, and decoding it does not make it safe. Use the tool to understand what something is, then decide what to do with it.
FAQ
A way to represent any data using 64 safe text characters: A to Z, a to z, 0 to 9, plus two symbols.
No. It is an encoding, not encryption. Anyone can decode it.
A variant that replaces + and / with – and _ so the result can be used in URLs without escaping.
The input may not be valid Base64, may be missing padding, or may encode binary data such as an image rather than text.
No. Encoding and decoding happen in your browser.
It handles text. For images, use the image to Base64 converter, which reads the file and produces a data URI.