How Base64 works, and when to use it
Base64 turns any sequence of bytes into plain text built from 64 safe characters: A to Z, a to z, 0 to 9, plus two extra symbols. It exists because many systems were designed to carry text, not raw bytes. Email bodies, JSON fields, HTML attributes and HTTP headers can all break or silently alter binary data, but they pass Base64 through untouched.
Base64 is an encoding, not encryption. Anyone can decode it, and this page does exactly that. Use it to move data safely through text-only channels, never to hide a secret.
How to use it
- Pick a direction: encode text to Base64, or decode Base64 back to its original bytes.
- Choose the alphabet. Standard uses + and / and pads the end with =. URL-safe swaps those for - and _ and drops the padding, so the result can sit inside a URL or a filename.
- Type or paste into the input box. The output updates as you type, and the Copy button puts it on your clipboard.
- When decoding something that is not text, such as an image or a key, switch the output to Hex bytes. Binary data rarely forms valid UTF-8, and hex keeps every byte readable and copyable.
Example: the same text in both alphabets
Hello, world!
Standard: SGVsbG8sIHdvcmxkIQ== URL-safe: SGVsbG8sIHdvcmxkIQ
13 bytes of text become 20 characters in the standard alphabet. The two = signs are padding that fills the last group of four; the URL-safe form leaves them out.
Why the output is about a third longer
Base64 reads the input three bytes (24 bits) at a time and writes them as four characters of 6 bits each. Four characters for every three bytes means the encoded form is roughly 33% larger than the original. When the input length is not a multiple of three, the last group is short, and the standard alphabet adds one or two = signs so the length stays a multiple of four.
That growth matters when you embed files. A 300 KB image placed in a CSS data URI as Base64 costs about 400 KB of text, and it can no longer be cached separately from the stylesheet that carries it.
Text, UTF-8 and emoji
Base64 works on bytes, so text must first become bytes. This tool always uses UTF-8, the encoding of the modern web. Accented letters take two bytes, most emoji take four, and the output grows accordingly. When decoding, the tool checks that the bytes really are valid UTF-8 and reports an error instead of printing garbled characters; switch to Hex bytes to see what is actually there.
Where you meet Base64 every day
JSON Web Tokens are three URL-safe Base64 pieces joined by dots. Email attachments travel as Base64 inside MIME messages. HTTP Basic authentication sends user:password as Base64, which is why it is only safe over HTTPS. Data URIs, PEM certificates and many API payloads that carry files use it too.
Questions
Is Base64 secure?
No. It hides nothing: decoding needs no key. If data must stay private, encrypt it first and Base64 the ciphertext only if you need to move it as text.
Why does my decode fail with an error?
Usually the input uses the other alphabet, has been cut short, or contains characters that are not Base64. Try switching between Standard and URL-safe. Line breaks and spaces are ignored in standard mode.
Can I encode a file?
Yes. Use the From file picker and the tool reads the file's bytes inside your browser, then encodes them. The file is never uploaded.
Do I need the = padding?
Most decoders accept both. Some strict ones need the padding, and URLs and JWTs leave it out. This tool adds missing padding itself when decoding the URL-safe form.