Free Free Tool

Base64 Encoder / Decoder

Encode text to Base64 or decode Base64 back to text. URL-safe mode supported.

Free · no sign-up
Instant results
Privacy-friendly

Direction

Alphabet

Input

Output

Other Developer Tools

JSON Formatter JSON → XML XML → JSON CSV → JSON JSON → CSV Base64 HTML Entities Markdown → HTML UUID Generator JWT Decoder Slug Generator HTML Live Editor Python Compiler C Compiler

What Base64 is for

Base64 rewrites arbitrary binary data using only 64 printable characters, so it can travel through channels that were designed for text. That is the whole purpose: email bodies, JSON string values, HTML data URIs, HTTP headers, and certificate files are all text-only, and raw bytes passing through them get mangled.

Encoding takes three bytes at a time and expresses them as four characters, which is why Base64 output is always about 33% larger than the input. That overhead is the price of safe transport, and it is worth remembering before you inline a large image as a data URI.

Standard versus URL-safe

The standard alphabet ends with + and / and pads the output with = so its length is always a multiple of four. That is fine inside a JSON value or an email, and a problem in a URL: + means a space in a query string, / is a path separator, and = separates a parameter from its value. Put standard Base64 in a URL without escaping it and it will be corrupted on arrival.

URL-safe mode fixes this by substituting - for + and _ for /, then dropping the = padding entirely. This is the variant defined in RFC 4648 section 5 and it is what JSON Web Tokens, OAuth parameters, and most modern APIs use. If a value you are decoding contains - or _ but no + or /, it is almost certainly URL-safe. Pick the matching mode and it will decode cleanly.

Base64 is not encryption

This is the single most consequential misunderstanding about Base64, and it causes real security incidents. Encoding is fully reversible by anyone, with no key and no secret — the button on this page does exactly that. A Base64 string looks scrambled to a human, which is precisely why it gets misused as if it were protection.

A password, API key, or access token stored as Base64 is stored in plaintext with extra steps. Anything genuinely confidential needs real cryptography: a password hash such as bcrypt or Argon2 for credentials you verify, and authenticated encryption for data you need to read back. HTTP Basic authentication is a good illustration — it Base64-encodes your username and password purely for transport, which is why it is only ever acceptable over HTTPS.

When decoding fails

Two causes account for nearly every failure. The first is a mismatched alphabet — feeding URL-safe input to a standard decoder, or the reverse. The second is truncation: Base64 length must be a multiple of four once padding is accounted for, so a string copied out of a wrapped terminal or a line-broken email often loses characters. Copying the value directly from its source rather than from a rendered view usually fixes it.

It is also worth knowing that decoding produces bytes, not necessarily readable text. If the original data was an image or a compressed archive, the decoded output will look like noise in a text box — that is correct behaviour, not an error.

Frequently asked questions

Is Base64 a form of encryption? #

No, and treating it as one is a genuine security risk. It is a reversible transport encoding with no key involved — anyone can decode it instantly. Use bcrypt or Argon2 for passwords and real authenticated encryption for confidential data.

When should I use URL-safe mode? #

Whenever the value will appear in a URL, a query parameter, or a filename. Standard Base64 uses +, / and = which all have special meaning in URLs. URL-safe mode swaps in - and _ and drops padding, which is what JWTs and most modern APIs use.

Why is my encoded string bigger than the original? #

Base64 represents every three bytes as four characters, so output is roughly 33% larger. That is inherent to the format. It is worth keeping in mind before embedding large images as data URIs, since it inflates your HTML or CSS payload.

My Base64 will not decode. What is wrong? #

Usually one of two things: the alphabet does not match (URL-safe input in a standard decoder or vice versa), or the string was truncated by line wrapping when it was copied. Copy the value straight from its source rather than from a wrapped display.

Why does the decoded output look like garbage? #

Because the original data was binary rather than text. Base64 decoding returns bytes; if those bytes were a PNG or a zip file, they will not render as readable characters in a text field. That is expected.

What does the = at the end mean? #

It is padding, added so the encoded length is a multiple of four. One or two = characters may appear. URL-safe mode omits padding entirely, and most decoders can reconstruct it, which is why its absence rarely causes problems.