Free · No sign-up · Runs entirely in your browser, nothing sent to a server
Encode text to Base64 or decode it back — with full UTF-8 support and the URL-safe alphabet used by JWTs and APIs accepted automatically.
This is the point worth getting right before anything else, because getting it wrong causes real breaches.
| Encoding (Base64) | Encryption | Hashing | |
|---|---|---|---|
| Purpose | Make data transmissible | Make data unreadable | Verify integrity or identity |
| Needs a key | No | Yes | No |
| Reversible | Yes, by anyone | Only with the key | No, by design |
| Provides secrecy | None at all | Yes | Not applicable |
| Examples | Base64, URL encoding, hex | AES, RSA, TLS | SHA-256, bcrypt, Argon2 |
If you need secrecy, encrypt. If you need to store a password, hash it with a slow algorithm designed for the purpose. Base64 is neither, and treating it as either is a serious mistake. For generating credentials worth protecting, see our password generator.
The mechanism is simple once you see it. Base64 regroups bits: it takes three bytes of 8 bits and re-slices them into four groups of 6 bits.
Six bits can hold 64 values, which is where the name comes from. Those values map to a fixed alphabet: A–Z (0–25), a–z (26–51), 0–9 (52–61), then two more — + and / in the standard alphabet.
| Input length | Output | Padding |
|---|---|---|
| 3 bytes | 4 characters | None |
| 2 bytes | 4 characters | One = |
| 1 byte | 4 characters | Two == |
Every 6-bit group maps to one of these. The two highlighted rows are the only difference between the standard and URL-safe variants.
| # | Char | # | Char | # | Char | # | Char |
|---|---|---|---|---|---|---|---|
| 0 | A | 16 | Q | 32 | g | 48 | w |
| 1 | B | 17 | R | 33 | h | 49 | x |
| 2 | C | 18 | S | 34 | i | 50 | y |
| 3 | D | 19 | T | 35 | j | 51 | z |
| 4 | E | 20 | U | 36 | k | 52 | 0 |
| 5 | F | 21 | V | 37 | l | 53 | 1 |
| 6 | G | 22 | W | 38 | m | 54 | 2 |
| 7 | H | 23 | X | 39 | n | 55 | 3 |
| 8 | I | 24 | Y | 40 | o | 56 | 4 |
| 9 | J | 25 | Z | 41 | p | 57 | 5 |
| 10 | K | 26 | a | 42 | q | 58 | 6 |
| 11 | L | 27 | b | 43 | r | 59 | 7 |
| 12 | M | 28 | c | 44 | s | 60 | 8 |
| 13 | N | 29 | d | 45 | t | 61 | 9 |
| 14 | O | 30 | e | 46 | u | 62 | + → - |
| 15 | P | 31 | f | 47 | v | 63 | / → _ |
Values 0–25 are A–Z, 26–51 are a–z, 52–61 are 0–9, and the last two are + and / — or - and _ in the URL-safe alphabet.
RFC 4648 defines two variants, and mixing them up is the most common practical problem with Base64.
| Standard (§4) | URL-safe (§5) | |
|---|---|---|
| Character 62 | + | - |
| Character 63 | / | _ |
| Padding | = required | Often omitted |
| Used in | Email attachments, data URIs, general encoding | JWTs, URL parameters, filenames, API tokens |
This tool accepts both when decoding, and restores missing padding automatically. Paste a JWT segment, an OAuth token or a URL parameter and it will decode without you needing to convert it first. When encoding, the URL-safe form is shown beneath the output whenever it differs.
Paste any of these into the tool above. Every value below was generated and verified rather than typed.
| What it is | Input | Base64 |
|---|---|---|
| Plain text | Hello World | SGVsbG8gV29ybGQ= |
| JSON payload | {"user":"alice","admin":false} | eyJ1c2VyIjoiYWxpY2UiLCJhZG1pbiI6ZmFsc2V9 |
| UTF-8 with accents | café façade | Y2Fmw6kgZmHDp2FkZQ== |
| Emoji | G'day 🇦🇺 | RydkYXkg8J+HpvCfh7o= |
| HTTP Basic Auth | admin:password | YWRtaW46cGFzc3dvcmQ= |
A real JWT payload, in base64url with the padding stripped — exactly as it appears in a token. Paste it into the decoder to see it work:
That decodes to {"sub":"1234567890","name":"Jane Citizen","admin":true} — readable by anyone who has the token, which is the point worth remembering about JWTs.
| Context | What Base64 is doing |
|---|---|
| JSON Web Tokens | The header and payload are base64url-encoded JSON. Anyone can read them — the signature provides integrity, not secrecy |
| Email attachments (MIME) | Email was designed for 7-bit text. Base64 lets binary attachments survive it, wrapped at 76 characters per line |
| Data URIs | Embedding a small image directly in HTML or CSS: data:image/png;base64,iVBORw0… |
| HTTP Basic Auth | Username and password joined by a colon, then encoded. Readable by anyone — safe only over HTTPS |
| API payloads | Sending binary data such as files or images inside JSON, which cannot carry raw bytes |
| Configuration and secrets | Kubernetes secrets, for instance, are Base64-encoded — which is encoding, not protection |
| Certificates (PEM) | The text between BEGIN and END markers is Base64-encoded binary |
Embedding an image as a data URI removes an HTTP request, which sounds like a straightforward win. The trade-off is size.
| Original image | As Base64 | Verdict |
|---|---|---|
| 1 KB icon | ~1.37 KB | Usually worth it — saves a request |
| 10 KB logo | ~13.7 KB | Borderline; depends on caching |
| 100 KB photo | ~137 KB | Rarely worth it |
| 1 MB image | ~1.37 MB | No — use a normal image file |
Base64 encodes bytes, not characters — so any text has to become bytes first, and that step is where many tools fail.
JavaScript's built-in btoa() only accepts characters in the range 0–255. Feed it an emoji, a Greek letter or Chinese text and it throws an error. The fix is to convert the text to UTF-8 bytes first, which is what this tool does.
| Text | UTF-8 bytes | Base64 |
|---|---|---|
| Hi | 2 | SGk= |
| café | 5 — é takes two | Y2Fmw6k= |
| 日本語 | 9 — three each | 5pel5pys6Kqe |
| 😀 | 4 | 8J+YgA== |
Notice that "café" is four characters but five bytes, and a single emoji is four bytes. That is UTF-8: common Latin characters take one byte, accented characters two, most CJK three, and emoji four. The calculator above reports both counts so the difference is visible.
| Language | Encode | Decode |
|---|---|---|
| JavaScript | btoa(unescape(encodeURIComponent(s))) | decodeURIComponent(escape(atob(b))) |
| Python | base64.b64encode(s.encode()) | base64.b64decode(b).decode() |
| Python (URL-safe) | base64.urlsafe_b64encode(...) | base64.urlsafe_b64decode(...) |
| PHP | base64_encode($s) | base64_decode($b) |
| Command line | echo -n "text" | base64 | echo "dGV4dA==" | base64 -d |
What is Base64?
Base64 is an encoding scheme that represents binary data using 64 printable characters — A–Z, a–z, 0–9 and two symbols. It exists so that binary data can pass through systems designed only for text, such as email or JSON. It regroups every three bytes into four characters, which is why encoded data is about a third larger.
Is Base64 encryption?
No. Base64 provides no security whatsoever. It requires no key and anyone can reverse it instantly — this page does it in one click. Encryption uses a key and is unreadable without it. If you need to protect data, encrypt it; if you need to store a password, hash it with an algorithm designed for that purpose.
Why is Base64 used?
Because many systems only handle text safely. Email was built for 7-bit characters, JSON cannot carry raw bytes, and URLs treat certain characters specially. Base64 converts binary data into a form that survives all of them intact, at the cost of about 33% extra size.
What is the difference between standard and URL-safe Base64?
The standard alphabet uses + and / for the last two characters; the URL-safe variant defined in RFC 4648 section 5 uses - and _ instead, and often drops the = padding. This matters because + means a space in a URL and / separates path segments. JWTs and most modern APIs use the URL-safe form. This tool accepts both and restores missing padding automatically.
Why does my Base64 string end in equals signs?
Base64 output comes in blocks of four characters representing three bytes. When the input does not divide evenly by three, padding fills the remainder — one = if two bytes remain, two == if one byte remains. The padding is not data; it just marks how many bytes the final block holds.
How much larger does Base64 make data?
Roughly 33%, because four characters carry what three bytes did, plus up to two padding characters. A 100 KB image becomes about 137 KB. This matters when embedding images as data URIs or sending files inside JSON payloads, and it is one reason large files are usually sent as separate binary uploads.
Can Base64 encode images?
Yes — that is what a data URI does, embedding the image directly in HTML or CSS as data:image/png;base64 followed by the encoded bytes. It saves an HTTP request but adds about a third to the size and prevents the browser caching the image separately. Worth it for tiny icons, rarely worth it above about 10 KB.
Why does Base64 fail on emoji or accented characters?
Base64 encodes bytes, not characters, so text must be converted to bytes first. JavaScript's built-in btoa() only accepts characters in the range 0–255 and throws an error on anything else. The solution is to convert to UTF-8 bytes before encoding, which this tool does — emoji, accented characters and CJK scripts all round-trip correctly.
Is a JWT encrypted?
No. A JWT's header and payload are base64url-encoded JSON that anyone can decode and read. The signature proves the token was issued by someone holding the signing key and has not been altered since — that is integrity and authenticity, not confidentiality. Never put sensitive data in a JWT payload.
Are Kubernetes secrets encrypted?
Not by default. Kubernetes secrets are Base64-encoded, which prevents formatting problems in YAML but provides no protection at all — anyone who can read the secret object can decode it instantly. Protecting them requires encryption at rest, appropriate access controls, or an external secrets manager.
Why does my command-line Base64 differ from this tool?
Almost always a trailing newline. Running echo "text" without the -n flag appends a newline character, which gets encoded along with your text and produces a different string. Use echo -n, or printf, to encode exactly what you intended.
Is this tool safe for sensitive data?
Everything runs in your browser — nothing is transmitted, logged or stored, and you can verify that by disconnecting from the internet and watching it still work. That said, remember what Base64 is: encoding it does not protect anything. If the data is genuinely sensitive, the question is whether it should be encoded at all rather than encrypted.
Base64 does one job well: it lets binary data travel through channels built for text. It costs about a third in size and provides exactly zero confidentiality — and understanding that second point is what separates a useful tool from a security incident.
For related tools, the URL encoder and decoder handles the different problem of reserved characters in web addresses, and the password generator creates credentials that genuinely are protected.