Base64 Encoder and Decoder
A free online Base64 encoder and decoder. Paste text to encode it, or paste Base64 to decode it back, with the URL-safe alphabet, line wrapping and padding all under your control. Everything is converted in your browser — nothing is uploaded.
Encode or decode
Paste your text or your Base64 below. It converts in your browser as you type, and nothing is uploaded or stored.
Paste something above to convert it.
Nothing converted yet.
Your text is converted locally with JavaScript. It is never sent to a server, never logged and never saved — not even in your browser storage.
The details that trip people up
=. base64url usually drops them. A strict decoder rejects the unpadded form, which is why the same string can work in one library and fail in another.+ and /. Both are unsafe in a URL, so base64url swaps them for - and _. Decoding one as the other silently corrupts the bytes.Base64 takes arbitrary bytes and rewrites them using 64 characters that survive any text channel. It is not encryption and not compression — it is a way to carry binary data somewhere only text is allowed, at the cost of making it about a third larger. This tool converts in both directions and shows you exactly what changed.
Key benefits
Common use cases
How to use it
- 1.Pick a direction. Choose Text → Base64 to encode, or Base64 → Text to decode. A data: URI prefix is stripped for you.
- 2.Paste your input. It converts as you type. Whitespace and line breaks in Base64 input are ignored, so a wrapped MIME block pastes in fine.
- 3.Set the options. Turn on the URL-safe alphabet for JWTs and query strings, or 76-character line breaks for MIME and PEM.
- 4.Copy or round-trip. Copy the result, or press Swap to feed it back in with the direction flipped and confirm you get the original back.
The details that trip people up
Base64 looks simple until an encoder and a decoder disagree about one of these four things. Each one is a real source of "it decodes everywhere except here".
=. base64url usually drops them. A strict decoder rejects the unpadded form, which is why the same string can work in one library and fail in another.+ and /. Both are unsafe in a URL, so base64url swaps them for - and _. Decoding one as the other silently corrupts the bytes.Key features
- Converts both directions, with a swap button for round trips
- Standard and URL-safe (base64url) alphabets
- Optional 76-character line wrapping for MIME and PEM
- Accepts unpadded, wrapped and data: URI input without complaint
- Shows input and output size and the encoding overhead
- Falls back to a hex view when the decoded bytes are not text
- Works offline once the page has loaded; no account, no upload
Base64 is not security
This needs saying plainly, because the mistake is common and expensive. Base64 is an encoding, not a cipher. It has no key, it hides nothing, and reversing it takes one function call. A password, token or API key that is "Base64 encoded" is stored in plain text as far as an attacker is concerned.
The clearest example is Authorization: Basic, which is just user:password in Base64 — readable by anyone who can see the request, which is exactly why it must only ever travel over HTTPS. Use Base64 to move bytes through a text-only channel. Use real encryption, or a signed token, when you need the contents protected. For the long version — how three bytes become four characters, the two alphabets, the padding, and the size cost — read our guide to Base64 encoding and decoding.
Frequently asked questions
What is Base64 used for?⌄
Base64 moves binary data through channels that only accept text: email attachments, data: URIs in CSS and HTML, certificates and keys in PEM files, JSON fields, and HTTP headers such as Authorization: Basic. Anywhere raw bytes would be corrupted or rejected, Base64 gets them through intact.
Is Base64 encryption?⌄
No. Encoding and encryption are different things. Base64 uses no key and provides no secrecy — decoding it is a single function call, which this page does as you type. Never use it to protect a password, token or any other secret.
What is the difference between Base64 and base64url?⌄
Only two characters and the padding. Standard Base64 ends its alphabet with + and /, which have special meaning in a URL, so base64url uses - and _ instead and normally omits the = padding. JWTs use base64url. Decoding one variant as the other corrupts the output, so this tool accepts both and tells you which it saw.
Why is my Base64 longer than the original?⌄
Every three bytes of input become four characters of output, so the result is about 33% larger, before padding and line breaks. That is the price of using only text-safe characters. If size matters, compress before encoding, not after — Base64 output barely compresses.
Why does my decoded text look like gibberish?⌄
Usually one of three things: the data was never text to begin with (an image or a key, in which case this tool shows you the bytes instead), the string is base64url being decoded as standard Base64 or vice versa, or the original bytes were not UTF-8. The conversion details panel names the alphabet and the padding it detected, which normally identifies the problem straight away.