Base64 Encode / Decode
Convert text to and from Base64 instantly, with full Unicode support - all in your browser.
- Free, no account
- No watermark
- No usage limit
About the Base64 Encode / Decode
Most Base64 converters handle plain English just fine. Hand one an emoji or an accented letter and a lot of them quietly break, either throwing an error or giving back scrambled text with no warning. That's the real line between a Base64 tool that works and one that corrupts your data, and it's the reason this one exists. It encodes as UTF-8 first, so café, a lone 🌍, Chinese, Arabic, Cyrillic, all of it round-trips cleanly instead of coming back as garbage.
The obvious job is here too: paste text to get Base64, or paste Base64 to get your text back. It's free, updates live as you type, and everything runs in your browser, so a session token or API key you paste never touches a server.
Base64 itself is quick to describe. It re-spells any data using a small set of safe printable characters (A-Z, a-z, 0-9, plus + and /) so that data can ride through channels built only for text: email, JSON, a URL, an HTTP header. It's the thing quietly carrying a PDF attachment or the payload of a login token. It's a simple idea, and the trouble only starts with what counts as "text" going in.
How to use
- Pick a direction. The Encode and Decode buttons at the top flip between turning text into Base64 and turning Base64 back into readable text. Decode is the one most people actually want, so it gets its own button up top.
- Paste your input. Type or paste into the box. The output updates on every keystroke. No submit button, nothing to click.
- Read the result. The output box is read-only. When you decode, any stray whitespace wrapped around the string gets trimmed for you, so a value you copied out of a log file or a pretty-printed JSON blob with line breaks still decodes.
- Copy, download, swap, or clear. Copy result drops the output on your clipboard, Download saves it as a
.txt, and Clear empties both boxes. Swap is the useful one: it pushes the output back into the input and flips the mode, which is the fastest way to confirm a value survives a full round-trip.
Why emoji and accents break other tools
This is where the cheap converters fail silently, and you don't find out until something downstream is already wrong.
Base64 works on bytes, not characters. So any text has to be turned into bytes before it can be encoded, and the byte encoding you choose decides whether you get your text back. Plain ASCII is one byte per character, so it converts without trouble. Everything else depends on getting this step right.
JavaScript ships with a built-in encoder called btoa(), and plenty of quick online tools are barely more than a wrapper around it. btoa() assumes every character fits in a single Latin-1 byte. The moment you feed it an emoji, an accented vowel, or any non-Latin script, it either throws or mangles the output. Sometimes you get an error, sometimes you just get wrong data with no complaint at all, which is worse.
This tool converts your text to UTF-8 bytes first, then encodes those. UTF-8 is what the modern web actually runs on, so the result lines up with what a correctly written server, browser, or language will decode on the other end. Send naïve through and it comes back naïve. Same for a run of Chinese characters, same for that emoji. If some other tool scrambled your text and this one didn't, a UTF-8 mismatch is almost always the reason.
It's encoding, not encryption, and that mix-up bites people
Say it flat out: Base64 hides nothing, with no key, no secret, and no protection whatsoever. Anyone can paste your string into a decoder (this one included) and read the original instantly.
Obvious, until you notice how often it gets treated as if it were security. "The password is Base64-encoded in the config file" describes a plaintext password that's just harder to recognize. An HTTP Authorization: Basic header looks scrambled, but Basic dXNlcjpwYXNz decodes right back to user:pass in a single click. The thing protecting Basic auth in transit is the HTTPS connection wrapped around it, the Base64 contributes exactly zero secrecy. Same deal with a JSON Web Token: the header and payload are Base64 you can read, so never park anything sensitive in a token payload assuming it's tucked away.
The rule is short: if you need something private, encrypt it. Proving data wasn't tampered with is a job for a hash. Base64 just moves data safely through a text-only pipe.
Padding and the URL-safe variant
Two details cause most confused decode failures.
The first is padding. A lot of Base64 ends in = or ==, which reads like a mistake but isn't. Base64 works through input in three-byte groups. When the final group comes up short, = fills the gap so the length still works out. One leftover byte gives you ==, two leftover bytes give a single =. Some formats drop the padding on purpose, so a string with no trailing = isn't broken either.
The second is the URL-safe flavor. Standard Base64 uses + and /, but both mean something else inside a URL (a + can be read as a space, a / is a path separator). So a variant called Base64URL swaps + for - and / for _, and usually skips the padding. That's the flavor JWTs and OAuth use. This tool decodes the standard alphabet, so if it refuses a string that contains - or _, you're looking at Base64URL: swap those two characters back and it'll decode. When a decode genuinely can't work, the tool says what to check, stray characters or missing padding, and leaves the output empty rather than guessing at bytes that aren't there.
Frequently asked questions
Does Base64 make my data smaller?
The opposite. It runs about 33% larger than the input, because it spends four output characters for every three input bytes. Encode a 3 MB file and you get roughly a 4 MB string. That expansion is baked into the format, which is why inlining a big image as Base64 is usually a poor trade. It's fine for a tiny icon but not worth it for a big one.
Can I encode an actual file or image here, not just text?
This tool is text in, text out. It doesn't take file uploads. If you already have the Base64 of a file and want to inspect or verify it, paste it into Decode and read what's there. To turn a raw binary file into Base64 in the first place, you want a dedicated file-to-Base64 converter instead, since that's a different input entirely.
Why does my JWT only partly decode?
A JWT has three dot-separated pieces. The first two, the header and payload, are Base64URL-encoded JSON, so they decode into readable text once you swap any - back to + and _ to /. The third piece is the signature, which is a hash tied to a secret. It's not text and it won't turn into anything readable no matter what you do, that's by design.
What's the difference between Base64 and hex?
Both turn binary into printable text, they just use different alphabets. Hex uses 16 characters (0-9 and a-f) and doubles the size, two characters per byte. Base64 uses 64 characters and adds only about a third. Hex is easier to read a single byte out of by eye, Base64 is denser, which is why data meant to travel tends to use Base64.
Is it safe to paste a real token or key in here?
From this tool's side, yes. Every bit of encoding and decoding happens locally in your browser, nothing is sent, saved, or logged, and closing the tab wipes it. The habit worth keeping is broader: never paste a live production credential into a tool that runs on a server, because a bearer token is a working key and whoever receives it can act as you. Client-side is the whole reason a tool like this is the safe place to inspect that stuff.
Why did my decode come back empty with an error?
The input wasn't valid Base64. Usual suspects are characters outside the alphabet, a Base64URL string with - or _ fed into a standard decoder, stray quotes or newlines pasted in from an editor, or broken padding. Double-encoding trips it too, where something already Base64-encoded got encoded a second time and now decodes to more Base64 instead of your text. Strip the surrounding junk and try again.
There's a second way to land on an error, and it isn't a typo. Perfectly good Base64 can hold bytes that simply aren't text, which is what a JWT signature or a slice of an image looks like. The message tells you which of the two you hit, so you know whether hunting for a stray character is worth your time.