What Base64 is

Base64 (RFC 4648) represents binary data using 64 printable ASCII characters: A–Z, a–z, 0–9, + and /. Every 3 bytes of input become 4 characters of output, so encoded data is about 33% larger. It exists so that arbitrary bytes can travel through systems that only handle text safely: email bodies, JSON strings, HTTP headers, URLs, HTML attributes.

Base64 is an encoding, not encryption. Anyone can decode it. It hides nothing.

Text is bytes first

Base64 operates on bytes, so text must be converted to bytes before encoding. This tool uses UTF-8, which is what the web, JSON and nearly every modern API assume. That is why é becomes two bytes (C3 A9) and the emoji 🚀 four. If a value decoded elsewhere looks wrong, the other side probably used a different text encoding (Latin-1, UTF-16), not a different Base64.

When decoding, the result is interpreted as UTF-8. If the bytes are not valid UTF-8, which means the input was probably binary (an image, a key, a compressed blob), the output pane shows a hex dump instead, and Download saves the raw bytes.

Base64url and padding

Standard Base64 uses + and /, both of which have meaning inside URLs, and pads to a multiple of 4 with =. Base64url (RFC 4648 §5) swaps them for - and _ and usually drops the padding. It is what JWTs, OAuth PKCE verifiers and many API keys use. The decoder here accepts both alphabets, with or without padding, and ignores whitespace and line breaks (older MIME encoders wrap at 76 characters).

Standard

Pz8/Pj4+

URL-safe

Pz8_Pj4-

Data URLs

A data URL embeds a file inline: data:image/png;base64,iVBORw0KGgo…. Tick Data URL after opening a file to produce one, ready to paste into an src or a CSS url(). Keep them small; a 100 KB image becomes a 133 KB string that cannot be cached separately.

Common errors

Invalid character. Something other than the 64 symbols, = or whitespace is present. Often a stray quote, a trailing comma, or a URL-encoded string (%2B instead of +); run it through the URL decoder first.
Invalid length. A Base64 string (without padding) can never leave a remainder of one character when divided by four. The input is truncated.
Garbage after decoding. Valid Base64, but the bytes are binary, compressed or encrypted. The hex dump shows what you actually have.

Base64 in code

JavaScript (browser and Node)

// Browser: btoa/atob work on Latin-1 strings only. For UTF-8, go through bytes:
const bytes = new TextEncoder().encode("Zoë");
const b64 = btoa(String.fromCharCode(...bytes));           // "Wm/Dqw=="
const back = new TextDecoder().decode(Uint8Array.from(atob(b64), c => c.charCodeAt(0)));
// Node
Buffer.from("Zoë").toString("base64");                     // "Wm/Dqw=="
Buffer.from("Wm_Dqw", "base64url").toString();             // "Zoë"

Python

import base64
base64.b64encode("Zoë".encode()).decode()          # 'Wm/Dqw=='
base64.urlsafe_b64encode(b"???>>>").decode()       # 'Pz8_Pj4-'
base64.b64decode("Wm/Dqw==").decode()              # 'Zoë'

Command line

printf 'Zoë' | base64            # Wm/Dqw==
echo 'Wm/Dqw==' | base64 --decode

Privacy note

Encoding and decoding happen in your browser with a small, dependency-free implementation. Files opened here are read locally with the File API; nothing is uploaded. Base64 is often used for secrets and tokens, so this matters.

Base64 Encoder / Decoder