Base64 Encoder / Decoder

A Base64 encoder is a tool that converts arbitrary binary or text data into a 64-character ASCII alphabet so it can travel through systems that only accept printable characters. The format is defined in RFC 4648  and uses the letters A-Z, a-z, the digits 0-9, plus + and /, with = as padding. The decoder reverses the process, turning the ASCII string back into the original bytes.

Backend engineers reach for a Base64 encoder when embedding images in CSS data URLs, attaching binary blobs to JSON payloads, signing JWTs, or sending credentials in HTTP Authorization: Basic headers. The encoding adds roughly 33% overhead in size, but it guarantees the data survives email, URLs, XML, and any other 7-bit transport untouched.

Why use a Base64 encoder?

• Send binary data through text-only channels. Email bodies, JSON fields, and XML attributes reject raw bytes. Base64 wraps them in safe ASCII so the payload arrives intact.
• Inline assets without extra HTTP requests. A 4 KB icon encoded as a data URL ships inside the CSS file, removing a round trip on first paint.
• Decode auth headers fast. Pasting an Authorization: Basic value into the decoder reveals the username:password pair in one click, which speeds up debugging broken API calls.
• Inspect JWT segments by hand. The three parts of a JWT are Base64URL-encoded JSON. Decoding them surfaces the header, claims, and signature exactly as the server saw them.
• Stay local for sensitive payloads. The encoder and decoder run entirely in your browser, so tokens and credentials never reach a third-party server.

How to use the Base64 Encoder / Decoder

1. Choose Encode to convert plaintext into Base64, or Decode to convert Base64 back into text.
2. Paste your input into the Plain text or Base64 field on the left.
3. Read the result on the right as you type. The output updates immediately, no submit step required.
4. Use the copy control on the output panel to grab the encoded or decoded string.
5. Switch modes and paste the output back in to verify a round trip matches your source.

How Base64 encoding works

Base64 takes three input bytes (24 bits) and rewrites them as four 6-bit groups, then maps each 6-bit value (0 through 63) to one character in the alphabet. When the input length is not divisible by three, the encoder pads the final group with = characters so the output length is always a multiple of four.

The alphabet defined in RFC 4648 section 4 looks like this:

Encoding the three-byte string Cat walks like this:

Input bytes:    C        a        t
ASCII (dec):    67       97       116
8-bit binary:   01000011 01100001 01110100
Regrouped 6:    010000   110110   000101 110100
Decimal:        16       54       5      52
Base64 char:    Q        2        F      0
Output:         Q2F0

A two-byte input ends with one = pad, and a one-byte input ends with two = pads. The URL-safe variant in RFC 4648 section 5 swaps + for - and / for _ so the string is safe in query parameters and filenames.

Examples

Encoding short strings to Base64:

Plaintext              Base64
hello                  aGVsbG8=
admin:secret           YWRtaW46c2VjcmV0
{"role":"admin"}       eyJyb2xlIjoiYWRtaW4ifQ==

A common HTTP example: encoding the basic auth pair api_user:t0p_s3cret produces the header value Basic YXBpX3VzZXI6dDBwX3MzY3JldA==, which the server reverses on arrival.

Common use cases

• Embed small images and fonts in CSS. background-image: url(data:image/svg+xml;base64,PHN2Zy...) removes one network request per icon.
• Carry binary attachments in JSON APIs. REST endpoints that accept file uploads through JSON usually expect the file body to be Base64-encoded.
• Build HTTP Basic auth headers. Encoding username:password is the entire spec behind the Basic scheme.
• Inspect tokens during QA. When a login flow fails, QA engineers Base64-decode the cookie or Authorization header to confirm the server received the expected identity.
• Move binary data through environment variables. CI systems and cloud secret managers store strings; Base64 lets you stash a TLS key or service account JSON without escaping issues.

Base64 vs alternatives

Frequently asked questions

Is Base64 encryption?

No. Base64 is an encoding, not encryption. Anyone who sees the encoded string can decode it with a single line of code. Use it to transport data safely, not to keep it secret. For confidentiality, wrap the value in TLS and store it with an authenticated cipher like AES-GCM.

Is Base64 secure?

The transformation itself adds zero security. A Base64 string is fully reversible without a key, so treating it as a password or token shield is a mistake. Anything sensitive that you Base64-encode is still effectively plaintext to a reader.

Why does my Base64 output end with =?

The = is padding. Base64 always emits groups of four characters; when the input length is not a multiple of three bytes, the encoder appends one or two = signs to round out the last group. Some variants strip the padding, which is valid as long as both ends agree.

What is the difference between Base64 and Base64URL?

Base64URL swaps two characters that break URLs: + becomes - and / becomes _. Padding is often omitted. JWTs use Base64URL for header, payload, and signature so the token can sit inside a URL or HTTP header without re-encoding.

How much larger is Base64 compared to the original?

About 33% larger. Three bytes of input become four bytes of output, and padding rounds up. A 9 KB image becomes a roughly 12 KB Base64 string, which is why inlining only makes sense for small assets.

Can Base64 handle Unicode text?

Yes, as long as the encoder reads the input as UTF-8 bytes first. This tool encodes the UTF-8 byte sequence, so emoji and non-Latin scripts round-trip correctly. In raw browser btoa, you need to UTF-8 encode the string yourself to avoid character errors.

Can I decode a Base64 string offline?

Yes. The tool runs in your browser using local JavaScript, so the input never leaves your device. You can also disconnect from the network and the encoder still works in an open tab.

Does Base64 add line breaks?

The original MIME variant (RFC 2045) wrapped lines at 76 characters. The newer RFC 4648 variant used here emits one continuous line. If you need 76-character wrapping for legacy systems, add line breaks after every 76 output characters.

Related tools

• URL Encode / Decode: Percent-encode strings for safe use in query parameters and paths.
• JWT Decoder: Split a JWT into header, payload, and signature without a secret.
• HTML Escape / Unescape: Convert <, >, &, and quotes to HTML entities and back.
• JavaScript Escape: Escape strings for safe embedding inside JavaScript source.