Base64 encoder and decoder
Runs in your browser; nothing is uploaded
Encode text or files to Base64, or decode Base64 back to text, bytes or an image. Invalid input points to the character.
Text
Base64
Base64 appears here as you type.
What is Base64?
Base64 is a way of writing any bytes using only 64 safe characters: A–Z, a–z, 0–9, + and /, with = used as padding at the end. Every 3 bytes of input become 4 characters of output, so encoded data is about a third larger than the original.
It exists because many systems only handle text reliably. Base64 lets you put binary data, such as an image, a file or a cryptographic key, inside JSON, an email, a URL or an HTTP header without it being corrupted on the way.
There are two alphabets. The standard one (RFC 4648) uses + and /. The URL-safe one uses - and _ instead, because + and / mean something in URLs, and usually leaves out the = padding; JWTs use it. Email (MIME) wraps standard Base64 at 76 characters per line.
In API work you meet it constantly. HTTP Basic authentication sends username:password Base64 encoded in the Authorization header, the parts of a JWT are URL-safe Base64, and many APIs return files or thumbnails as Base64 strings or data: URLs inside JSON. Base64 is an encoding, not encryption: anyone can decode it.
How to use this tool
- 1Choose Encode or Decode. Switching keeps what you typed; Swap (Alt+Shift+S) moves the output into the input and switches the mode.
- 2To encode, type text (it is encoded as UTF-8), or drop or open a file to encode its bytes exactly. URL-safe, Wrap at 76 and data: URL change the form of the result.
- 3To decode, paste Base64, wrapped MIME Base64 or a whole
data:URL. The alphabet and missing padding are detected for you, and the status bar says which form it was. - 4If the input isn't valid Base64, the character is marked in the editor and F8 goes to it. The message says what is wrong, such as a character outside the alphabet or the wrong amount of padding.
- 5Decoded text shows as text. Bytes that aren't UTF-8 text show as a hex dump, images show as a preview, and Download (Ctrl+S) saves the bytes as a file with the right extension.
Troubleshooting
.is not a Base64 character- The input is probably a JWT, whose three parts are separated by dots. Decode one part at a time, or paste the token into the JWT decoder.
%is not a Base64 character- The Base64 has been percent-encoded for a URL (
+became%2B,=became%3D). Decode it with the URL decoder first. - One character is missing or extra
- Base64 comes in groups of four characters, and this string ends with a group of one. It was almost certainly cut off when it was copied.
- The decoded bytes aren't UTF-8 text
- The data is binary (an image, a zip, a key) or text in another encoding such as Latin-1. Look at the Hex view or download the bytes instead of copying them as text.
- The result has a
�where an emoji should be - The text you encoded contained half of an emoji, usually from cutting a string in the middle of one. The status bar points to the character; the half can't be encoded, so it becomes U+FFFD.
Frequently asked questions
Is my data sent to a server?
No. Encoding, decoding and image previews run in your browser, and files you open are read locally. Text you paste is kept in this tab's session storage until you clear it or close the tab, so a reload doesn't lose it, and Copy link puts it in the link after #, which browsers never send to a server. The options you choose, such as URL-safe, are remembered in this browser.
Why are some encoded strings longer than others for the same number of characters?
Base64 encodes bytes, not characters. In UTF-8 an English letter takes 1 byte, an accented letter 2 bytes and many Asian characters 3 bytes, so text in those scripts produces longer Base64.
How do I decode a Basic auth header?
Take the part after Basic in the Authorization header and decode it here. The result is the username and password separated by a colon.
Do I need the `=` padding?
Most decoders, including this one, accept Base64 without padding, and URL-safe Base64 usually leaves it out. Some strict decoders require it; standard Base64 adds it so the length is a multiple of four.