Base64 Encode and Decode

How to use it

1. Pick Encode or Decode. Encoding turns your content into Base64; decoding does the reverse.
2. For text, type or paste into the first box. For a file, switch to File or image and drop one in. Either way the work happens on your own device.
3. Adjust the options if you need them — URL-safe characters, padding, line length, or a ready-made data: URL.
4. Copy the result, or download it. When a decode produces a picture or a PDF rather than text, you get a preview and a download button instead of a wall of symbols.

What Base64 actually is

Base64 is a way of writing arbitrary bytes using only 64 characters that survive being sent through systems built for text. Email bodies, JSON fields, XML attributes, URLs and HTML attributes all have opinions about which bytes are allowed. A PNG does not care about those opinions, and will be corrupted by them. Base64 is the translation layer that lets binary travel through a text-shaped pipe and come out the other end intact.

It takes three bytes at a time — 24 bits — and rewrites them as four characters of six bits each. That is where the well-known size increase comes from: four characters carrying what three bytes used to.

Base64 is not encryption

This is the single most costly misunderstanding about it. Base64 has no key and no secret. Anyone who sees the string can reverse it in one step — including on this page. It hides nothing.

Credentials that appear "encoded" in a config file, an HTTP header or a mobile app are not protected in any sense. An HTTP Basic authorization header is Base64 and is readable by anyone who can see the request, which is why it is only ever acceptable over HTTPS. If you need something to stay secret, you need encryption, and Base64 is at most the envelope you put the result in.

The alphabet

The last two positions are the only place the variants disagree. Standard Base64 uses + and /; the URL-safe variant uses - and _ so the value can sit in a query string or a filename without being escaped. This page detects which one you pasted, and will accept a value that mixes the two — which should not happen, but does.

Data URLs

A data: URL is Base64 with a type bolted to the front, so a file can be written directly into a stylesheet or a page instead of being fetched separately:

background: url(data:image/png;base64,iVBORw0KGgo…);

Tick As data: URL and the prefix is generated for you, with the type read from the file's own leading bytes rather than from its extension. This is genuinely useful for small icons, where saving a network request is worth the extra third in size. It is a bad trade for anything large: the bytes cannot be cached separately, and they bloat the file that carries them.

The mistakes that catch everyone

Emoji and accents coming out as rubbish

The browser's built-in btoa() only understands characters below U+0100. Hand it an emoji, a Chinese character or a name with an accent and it throws InvalidCharacterError, so a great many tools quietly strip or mangle those characters instead. The fix is to convert to UTF-8 bytes first. This page works on bytes from the start, so café, 世界 and 👋 all round-trip exactly.

"Invalid character" on a value that looks fine

Usually line breaks. Base64 that has travelled through email is wrapped at 76 characters, and strict decoders reject the newlines. Sometimes it is the quotes that came along when the value was copied out of JSON. This page removes both before decoding and tells you it did.

Missing padding

The trailing = characters pad the value to a multiple of four. Many encoders omit them, and many decoders then refuse the result. Padding carries no data, so it can always be recalculated — this page does that rather than failing.

Decoding something that was never text

If the bytes are a PNG, forcing them into a text box produces nothing but noise, and copying that noise destroys the file. When a decode yields bytes that are not valid UTF-8, you get the detected file type, the size and a download button instead.

Questions

Is my file uploaded anywhere?

No. The file is read by your browser and converted on your own machine. Nothing is sent to a server, which is also why there is no size limit imposed from outside — only what your device can hold in memory.

How large a file can I convert?

Up to about 32 MB comfortably. The limit is memory: the page has to hold the file and a Base64 string a third larger again at the same time. Very large results are shortened on screen, but Copy and Download still give you every character.

Why is my encoded string a third bigger?

Because four characters are being used to carry every three bytes. That overhead is inherent to the format, not a flaw in any particular tool, and it is the reason Base64 is a transport format rather than a storage one.

What is the difference between Base64 and Base64URL?

Only the last two characters of the alphabet, plus the convention that padding is usually dropped. Base64URL replaces + with - and / with _, because the originals mean something else inside a URL. JSON Web Tokens use the URL-safe form, which is why pasting one here works.

Can I decode a JWT with this?

Partly. A JWT is three Base64URL sections separated by dots. Paste one section at a time and you will get readable JSON for the header and the payload. The third section is a signature — real bytes, not text — so it will come back as a download rather than as something you can read.

Does it work offline?

Once the page has loaded, yes. All the conversion code is already on your device at that point.