How to use the Base64 tool
Type or paste text and press Encode to get its Base64 form, or paste a Base64 string and press Decode. The decoder is forgiving: it ignores line breaks, accepts both the standard and URL-safe alphabets, and adds missing = padding for you.
Tick URL-safe when the result is going into a URL, a filename or a JWT. It swaps + for -, / for _ and drops the padding, so nothing needs further escaping.
The file picker reads an image, font or any small file and gives you a data: URL you can paste straight into CSS or an <img src> attribute.
Why the browser's built-in btoa() isn't enough
If you've ever called btoa("Grüße") in the console you'll have met the "characters outside of the Latin1 range" error. The built-in function only understands single-byte characters. This tool first converts text to UTF-8 bytes with TextEncoder and then encodes those bytes, which is what every other system (Python, Java, the base64 command on Linux and macOS) does. The result is portable, and emoji and accented letters survive the round trip.
What Base64 is for
Base64 represents arbitrary bytes using only 64 safe characters: A–Z, a–z, 0–9, plus two symbols. It exists because many older protocols (email being the classic example) were designed for plain text and would mangle binary data. Today you'll meet it in:
- Email attachments (MIME)
- Data URLs for small inline images
- HTTP Basic authentication headers
- The header and payload of a JSON Web Token (try our JWT decoder)
- Kubernetes secrets and many CI/CD variables
Every 3 bytes become 4 characters, so encoded data is about 33% larger than the original.
Base64 is not encryption
This is worth repeating because it causes real security incidents. Anyone can decode Base64 instantly, including with this page. A Kubernetes secret or a Basic auth header is encoded, not protected. If you need confidentiality, use real encryption and keep the key somewhere else. We explain the difference in Base64 is not encryption.
Frequently asked questions
Why does decoding fail with a valid-looking string?
Either the string contains characters outside the Base64 alphabet, or it decodes to binary data (like an image) rather than UTF-8 text. Binary data cannot be shown as text.
What does the = at the end mean?
It is padding that makes the length a multiple of four. It carries no data and can be safely removed in URL-safe contexts.
Is Base64 the same as Base64URL?
They differ only in two characters (+/ versus -_) and the optional padding. This decoder accepts both.