Base64 Encoder & Decoder

What is Base64?

Base64 encodes data using 64 printable characters (A–Z, a–z, 0–9, + and /). It’s used to embed images in CSS, send binary data in JSON or emails, and pass data safely through systems that only handle text. This tool supports full UTF-8, so emoji and accented characters encode correctly, and it runs entirely in your browser — nothing is uploaded.

Important: Base64 is encoding, not encryption. It only rearranges data into a text-safe form; anyone can decode it. Never rely on it to hide passwords or secrets. For strong secrets, use our password generator.

How the encoding works

Base64 solves one problem: moving arbitrary bytes through a channel that only reliably carries text. It takes three bytes (24 bits) at a time and re-splits them into four 6-bit groups, each mapped to a printable character. Four characters for every three bytes is why encoded output is always about 33% larger than the input.

When the input length is not a multiple of three, the final group is padded with = — one for a two-byte remainder, two for a one-byte remainder. That is why so much Base64 ends in = or ==.

Base64 is not encryption

This matters more than any technical detail. Base64 is a reversible, keyless transformation that anyone can undo in one line of code. Encoding a password, token or API key does nothing to protect it. If content needs to be secret, encrypt it; if it needs to survive transport, encode it. The two are unrelated jobs.

Where you meet it

• Data URIs — small images and fonts embedded directly in CSS or HTML as data:image/png;base64,…, saving a request at the cost of size and cacheability.
• Email attachments — MIME has encoded binary attachments this way since 1992.
• JSON payloads — JSON has no binary type, so bytes travel as Base64 strings.
• JSON Web Tokens — a JWT is three base64url segments joined by dots; the payload is readable by anyone holding the token.
• HTTP Basic auth — user:password encoded, which is precisely why it requires HTTPS.

Standard vs URL-safe

Standard Base64 uses + and /, both of which have meaning in URLs and file paths. The base64url variant substitutes - and _ and usually drops the padding. If a decode fails on a value taken from a query string or filename, that substitution is nearly always the reason.

Unicode and line breaks

Text is encoded as UTF-8 bytes first, so a character outside ASCII consumes two to four bytes before encoding. Some legacy MIME implementations also expect a line break every 76 characters; modern APIs generally want one unbroken string. If a decoder rejects your input, check for stray whitespace before anything else.