Base64 Encode / Decode
Encode and decode Base64 and Base64URL with correct UTF-8 handling.
Private by design. Your input never leaves this browser. Conversions run locally on your device.
What this tool handles
- Encodes and decodes standard Base64 and the URL-safe alphabet that uses - and _.
- Padding with = can be switched off when encoding.
- Text is treated as UTF-8, so non-ASCII characters survive a round trip.
- Decoding accepts input with or without padding.
Example
Input
Žofie & AdaOutput
xb1vZmllICYgQWRhWhen you would use it
- Assembling a data: URI — An inline SVG or a small JSON payload in CSS or a src attribute goes after the media type as standard padded Base64. The input is text, so it encodes markup and strings rather than a binary file you drop on it.
- Reading an HTTP Basic auth header — The value after "Basic" is user:password in standard Base64 — decoding one tells you which account a stored credential or a captured request belongs to.
- Binary fields carried inside JSON — JSON has no byte type, so APIs pass certificates, keys and thumbnails as Base64 strings. Decoding one that really holds binary stops with a message saying so, because the output pane is text.
- A Base64 block copied out of a raw email — MIME wraps attachment bodies at 76 characters. All whitespace is removed before decoding, so a block pasted straight from the message source works without rejoining the lines.
Common questions
What is the difference between Base64 and base64url?
Only the last two symbols: base64url writes "-" and "_" where standard Base64 writes "+" and "/", so the result survives inside a URL path, a query string or a JWT segment untouched. The alphabet option picks which one to emit; decoding accepts either without being told.
Does the "=" padding matter?
Not for decoding here — padding is stripped first and unpadded input is accepted. It matters for stricter parsers: JWT segments are always unpadded, while a data: URI or an Authorization header normally carries the padding.
Does Base64 protect anything?
No. It is a transport encoding that anyone can reverse, so a Basic auth header is effectively a plaintext credential and a Base64 blob in a config file hides nothing from whoever can read the file.
Why is the output longer than the input?
Every three bytes become four characters, so the result grows by about a third. Multi-byte characters count as their UTF-8 bytes: "Z" with a caron is two bytes before encoding even though it is one character.
Related tools
- JWT Decoder — Decode a JSON Web Token header and payload locally. Signatures are not verified.
- URL Encode / Decode — Percent-encode or decode text, or break a full URL into its parts.
- cURL → code — Translate a cURL command into fetch, axios or Python requests code.
- Hash Generator — Compute SHA-256, SHA-384, SHA-512, SHA-1 and MD5 digests of text or a file.