Base64 Encoder / Decoder

Base64 is a way to represent binary data using 64 printable ASCII characters (A-Z, a-z, 0-9, and two symbols). It lets bytes - images, keys, anything - travel safely through channels that only handle text, like JSON, URLs, HTML, or email.

It is not compression and it is not encryption. In fact Base64 makes data about 33% larger; its only job is to survive text-only transport intact.

Base64 takes 3 bytes (24 bits) and splits them into 4 groups of 6 bits, then maps each 6-bit value (0-63) to a character. When the input is not a multiple of 3 bytes, = padding fills the gap - one = means 2 bytes of input, two means 1.

Standard Base64 uses + and /, which have special meaning in URLs and filenames. URL-safe Base64 swaps them for - and _ and usually drops the = padding, so the result is safe to drop into a query string, a path, or a JWT. This tool decodes either form automatically.

This is the most important thing to know: Base64 provides zero confidentiality. Anyone can decode it instantly - there is no key and no secret. Never use it to "hide" passwords, tokens, or other secrets; for that you need real encryption. Base64 is only for transporting data, not protecting it.

Many quick Base64 snippets call btoa() directly on a string, which throws on any non-Latin1 character - so btoa('café') or an emoji fails or corrupts. The fix is to encode the text to UTF-8 bytes first, then Base64 those bytes. This tool does that correctly, so accented characters, CJK, and emoji round-trip exactly.

• Data URIs - inline images, fonts, and SVGs directly in CSS or HTML.
• Email (MIME) - attachments are Base64-encoded, wrapped at 76 characters.
• JWTs - each part of a JSON Web Token is URL-safe Base64. Our JWT decoder splits and decodes all three parts for you.
• HTTP Basic auth - the user:password pair is Base64-encoded (not secured).
• Embedding binary in JSON / XML - keys, certificates, small blobs.