Base64 Encoder & Decoder Online (UTF-8 & URL-Safe)
Encode text, JSON, and binary data to Base64 format or decode Base64 strings with zero server logging.
Interactive Base64 Encoder & Decoder
Encode or decode strings locally with full UTF-8 support and URL-safe mode.
What this tool does and who it is for
This tool converts text to Base64 and back. It encodes through UTF-8 first, so accented letters, symbols, and emoji survive the round trip, and it has a URL-safe switch that swaps + and / for - and _ and drops the trailing = padding.
Developers reach for it constantly: reading the payload of a data URI, checking what an Authorization header actually contains, preparing a small value for a config file. Switch between Encode and Decode, or use the swap button to feed the output back in as the new input.
In decode mode it is forgiving. If the input contains - or _, it converts them back and restores missing padding, so URL-safe strings from JWTs and links decode without manual fixing. The result is interpreted as UTF-8 text, which matters if the source was binary.
Official Formula / Technical Standard
Real-World Worked Scenario
Text: 'Hello World 2026' -> Base64: 'SGVsbG8gV29ybGQgMjAyNg=='. URL-Safe variant replaces '+' with '-' and '/' with '_'.
When people use it
Peeking inside a JWT segment
The header and payload of a JSON Web Token are URL-safe Base64. Paste one segment, decode, and you will see the JSON claims. This only reads the token; it does not verify the signature.
Checking a Basic auth header
Basic authentication sends username:password as Base64. Decoding a captured header shows exactly which credentials a client is sending, which helps when you debug a 401.
Embedding a tiny asset
Encode a short SVG string or snippet for a data URI when you cannot host a separate file.
Making a value safe for a URL or env var
Encode a string that contains quotes or line breaks so it fits on one line in a .env file or query parameter, then decode it in your app.
Notes for US users
- Base64 hides nothing. Do not treat an encoded Social Security number, API key, or customer record as protected. If it appears in logs or emails, it is exposed in practice.
- US compliance frameworks such as HIPAA and PCI DSS treat encoded data the same as plain data. Encoding is not an accepted safeguard.
- Many US-based APIs (Stripe, Twilio, and others) use HTTP Basic auth, so you will see Base64 of key:secret pairs in examples. Decoding them locally beats pasting live keys into a site that sends them elsewhere.
Limits and what to double-check
- •Decoding assumes the bytes are UTF-8 text. Decoding an image or PDF will give you unreadable characters; this tool does not handle file input.
- •Invalid characters or broken padding produce an error rather than a partial result, so truncated strings need fixing before they decode.
- •Auto-detecting URL-safe input means a standard Base64 string that happens to contain - or _ is not valid anyway, but double-check if your source mixes alphabets.
Expert Best Practices & Common Pitfalls
Recommended Best Practices
- •Use URL-Safe Base64 (- and _ instead of + and /) when embedding Base64 strings into query parameters or URL paths.
- •Remember that Base64 increases payload size by approximately 33% compared to raw binary data.
- •Use UTF-8 encoding when converting international characters to prevent character corruption.
Common Mistakes to Avoid
- •Using Base64 as a method of encryption or security; Base64 is merely an encoding format that anyone can reverse in one click.
- •Pasting multi-megabyte files into text fields without checking browser memory limitations.
- •Forgetting to handle padding characters (=) when sending strings to strict decoders.
Features & Security Architecture
- 100% Client-Side: Zero server uploads ensure complete privacy and data confidentiality
- Fast Results: Processing happens on your own device, so there is no upload or server queue to wait for
- No Sign-Up Required: Completely free to use with no daily usage caps or account requirements
- Works on All Devices: Fully responsive across desktop, tablet, and mobile browsers
Frequently Asked Questions
Is Base64 an encryption method?▼
No. Base64 is an encoding algorithm, not encryption. It contains no secret key and provides zero confidentiality. Anyone who receives a Base64 string can instantly decode it.
Why does Base64 increase data size by 33%?▼
Base64 represents 24 bits of binary data (3 bytes) using 32 bits of text (4 characters of 8 bits each), creating a mathematical overhead of exactly 4/3, or a ~33% increase in data size.
What is the difference between standard and URL-safe Base64?▼
Standard Base64 uses + and /, which have special meaning in URLs, and pads with =. URL-safe Base64 replaces them with - and _ and usually omits the padding. JWTs and many link tokens use the URL-safe form. Use the toggle that matches whoever will read it.
Why do I get an invalid sequence error?▼
Common causes are stray spaces or line breaks inside the string, a character outside the Base64 alphabet, or truncation from copy and paste. Remove whitespace, confirm you copied the whole value, and check whether it is URL-safe. Padding is restored for you, so a missing = is rarely the cause.
Can I decode a Base64 image here?▼
Not usefully. The tool turns the bytes into text, and image bytes are not valid text, so you would see gibberish. For images, use the image-to-Base64 tool in the opposite direction, or open the data URI directly in a browser tab.
Does it handle emoji and non-English characters?▼
Yes. Input is converted to UTF-8 bytes before encoding, and decoded bytes are read as UTF-8. That is why a Base64 string made by this tool can differ from one made by a naive btoa call, which breaks on characters outside Latin-1.