Base64 Encoder & Decoder
Encode text to Base64 or decode Base64 back to text. UTF-8 safe with automatic direction detection.
How to use the Base64 Encoder
- 01
Type text to encode, or paste Base64 to decode.
- 02
The result appears instantly; the direction is detected automatically.
- 03
Copy the result from the output panel.
What Base64 is
Base64 represents binary or text data using just 64 printable ASCII characters (A-Z, a-z, 0-9, plus + and /), encoding every three bytes as four characters. That keeps data intact when it travels through systems that were built for text rather than raw bytes.
Where you see it
You see it everywhere: data URLs that embed an image directly in HTML or CSS, email attachments (MIME), the header and payload of a JSON Web Token, HTTP Basic authentication headers, and many API fields that need to carry binary data as a plain string.
How this tool handles it
This tool encodes text to Base64 and decodes Base64 back to text, choosing the direction automatically. It is UTF-8 safe, so accents, emoji and other Unicode characters survive the round trip without corruption, which the naive built-in browser functions do not guarantee on their own.
Encoding is not encryption
It is important to know what Base64 is not: it is an encoding, not encryption. Anyone can decode it instantly, so it provides zero security. Never use it to hide passwords, tokens or secrets. Its job is safe transport and representation, not confidentiality.
The size cost
Base64 also has a size cost. The encoded output is about 33 percent larger than the original, because four characters stand in for every three bytes. That trade-off is usually worth it for compatibility, but it is why you would not Base64-encode large files when a real binary channel is available.
Runs in your browser
Everything runs in your browser, so the text you paste is never uploaded. To turn an image file into a Base64 data URL instead of plain text, use the dedicated Image to Base64 tool.
Frequently asked questions
How does automatic detection work?
If your input looks like valid Base64 and decodes to readable UTF-8 text, it is decoded; otherwise it is encoded. This covers the common cases without a manual toggle.
Is it safe for non-English characters?
Yes. Encoding and decoding are UTF-8 safe, so emoji, accents and other Unicode characters round-trip correctly instead of turning into garbled output.
Can I protect passwords or secrets with this?
No. Base64 is an encoding, not encryption. It is trivially reversed and provides no security, so never use it to protect sensitive data. Use real encryption or hashing for that.
Why is the Base64 output larger than my input?
Base64 uses four characters to represent every three bytes, so the result is roughly 33 percent bigger than the original. That overhead is the cost of representing binary data with a small, text-safe character set.
What about URL-safe Base64?
Standard Base64 uses + and / with = padding, which can clash with URLs. A URL-safe variant replaces + and / with - and _. JWTs, for example, use the URL-safe form without padding.
Is my text uploaded anywhere?
No. Encoding and decoding happen entirely in your browser. Nothing you paste is sent to a server, stored or logged.
Sources
Learn more
Base64 Explained: Why Encoding Is Not Encryption
What Base64 actually does, why it makes data about a third larger, when to use it, and why it protects nothing on its own.
Are Online Encoder and Hash Tools Safe? How to Tell If One Uploads Your Data
Many online encoders and decoders send your input to a server. Here is how to tell whether a tool runs locally, and what never to paste in.
URL Encoding Explained: When and Why to Percent-Encode
Why URLs use %20 and other percent codes, which characters are safe, and when to reach for encodeURIComponent instead of encodeURI.
How to Read a JWT, and Why Decoding Is Not Verifying
A JWT is three Base64url parts anyone can read. Learn how to decode one, what each part means, and why decoding proves nothing.
Hashing vs Encryption: What a Hash Can and Cannot Do
Hashing is one-way and keyless; encryption is two-way and needs a key. Learn the difference, why you cannot decrypt a hash, and when to use each.
How Webhook Signatures Work: HMAC, Shared Secrets, and Timing-Safe Checks
How Stripe and GitHub prove a webhook is genuine using HMAC and a shared secret, and the timing-safe comparison most developers get wrong.