Encode / Decode
Base64 is encoding, not encryption. Anyone who can see it can reverse it.
Base64 is encoding, not encryption. Anyone who can see it can reverse it. If it felt like a secret, it isn’t.
Paste text or a Base64 blob. Encode for transport. Decode to see what you actually sent. URL-safe and standard are not interchangeable.
How to use it
- Standard Base64 uses
+and/, with=padding. URL-safe uses-and_, and often drops padding. Mixing them is the usual “why won’t this decode” bug. btoa()in a browser dies on Unicode. Characters above 255 throw. Encode UTF-8 bytes first, then Base64. This page should do that.btoa('✓')will not.- Whitespace in the blob is usually safe to strip. A missing
=at the end sometimes is, sometimes isn’t. If decode fails, add padding until the length is a multiple of 4.
When it breaks
- Binary files round-trip only if you treat the result as bytes, not as a JS string of “characters.”
- JWT uses Base64url without padding. A decoder that demands
=will reject a valid token. - Don’t store passwords in Base64. That’s just the password, longer.
Plain Text
Base64 Output
Features
- • Auto-detect: Automatically determines if input should be encoded or decoded
- • Binary Support: Detects file data (Images, PDF, ZIP) and offers download
- • UTF-8 Safe: Properly handles unicode characters including emoji 🎉
- • Validation: Shows detailed errors for invalid Base64 strings
Features
- Standard Base64 (A-Z a-z 0-9 + /) and a reminder that + / break URLs
- URL-safe alphabet uses - _ instead of + / (RFC 4648 §5)
- UTF-8 encode before btoa so emoji and non-Latin text do not throw
- Padding = is explained, not silently invented on decode unless needed
- Encoding is reversible by anyone. It is not a cipher
Common Use Cases
- Decode a Basic-auth header without treating it as a secret store
- See why a JWT-looking string fails standard atob (+ vs -)
- Fix InvalidCharacterError from btoa("café")
- Check padding on a PEM-style or MIME line
Base64 is encoding, not encryption
Base64 is encoding, not encryption. Anyone who can see it can reverse it. If it felt like a secret, it isn’t.
Paste text or a Base64 blob. Encode for transport. Decode to see what you actually sent. URL-safe and standard are not interchangeable.
Standard Base64 uses + and /, with = padding. URL-safe uses - and _, and often drops padding. Mixing them is the usual “why won’t this decode” bug. btoa() in a browser dies on Unicode. Characters above 255 throw. Encode UTF-8 bytes first, then Base64. This page should do that. btoa('✓') will not.
Whitespace in the blob is usually safe to strip. A missing = at the end sometimes is, sometimes isn’t. If decode fails, add padding until the length is a multiple of 4.
Examples
Hello, World!
→ SGVsbG8sIFdvcmxkIQ==standard: ab+c/d==
url-safe: ab-c_dbtoa("café") // InvalidCharacterError in browsers
// UTF-8 bytes of café → Y2Fmw6k=c2Vuc2l0aXZlLXBhc3N3b3Jk
→ sensitive-passwordFrequently Asked Questions
Base64 is encoding, not encryption. Anyone who can see it can reverse it. If it felt like a secret, it isn’t. Don’t store passwords in Base64. That’s just the password, longer.
Standard Base64 uses + and /, with = padding. URL-safe uses - and _, and often drops padding. Mixing them is the usual “why won’t this decode” bug. Whitespace in the blob is usually safe to strip. A missing = at the end sometimes is, sometimes isn’t. If decode fails, add padding until the length is a multiple of 4.
btoa() in a browser dies on Unicode. Characters above 255 throw. Encode UTF-8 bytes first, then Base64. This page should do that. btoa('✓') will not.
Binary files round-trip only if you treat the result as bytes, not as a JS string of “characters.” JWT uses Base64url without padding. A decoder that demands = will reject a valid token. Don’t store passwords in Base64. That’s just the password, longer.