network requests sent: 0

Base64 Encoder & Decoder

Encode text or a file to Base64, or decode Base64 back to text — including the URL-safe variant used in JWTs. It all happens locally in your browser, so it's safe to use on API keys, tokens and config values you wouldn't paste into a stranger's server.

Mode

Encode Decode

URL-safe alphabet (Base64URL) Include = padding

Input

Or encode a file Wrap as a data: URI

Up to 5 MB. The file is read in your browser and never uploaded.

Output

What this tool does and doesn't do

Base64 turns bytes into plain text using 64 safe characters, so binary data can travel through systems that only handle text. It is an encoding, not encryption: anyone can reverse it in a second, which is why an "encoded" secret is still a secret in plain sight.

Text is converted through UTF-8 first, so accented characters, symbols and emoji round-trip correctly. That's the step the browser's built-in btoa() skips — it only accepts Latin-1 and throws on anything else.

Standard versus URL-safe Base64

Standard Base64 uses + and / for its last two symbols and = for padding. All three have special meanings in URLs and filenames, so the URL-safe variant (Base64URL) swaps them for - and _ and usually drops the padding. JWTs use Base64URL.

When decoding, you don't need to choose: this tool accepts either alphabet, tells you which it found, and tolerates missing padding and line breaks. It does reject input that mixes both alphabets, since that can't be valid in either form.

Base64 on the command line and in code

# shell (GNU coreutils; -n avoids encoding a trailing newline)
printf 'hello' | base64
printf 'aGVsbG8=' | base64 -d

// Node.js
Buffer.from('hello').toString('base64');        // 'aGVsbG8='
Buffer.from('hello').toString('base64url');     // 'aGVsbG8'

# Python
import base64
base64.b64encode(b'hello')            # b'aGVsbG8='
base64.urlsafe_b64encode(b'hello')    # b'aGVsbG8='

In a browser, use TextEncoder to get UTF-8 bytes before btoa() if the text can contain anything beyond plain ASCII.

FAQ

Why does encoded data end with "=" or "=="?

Base64 works in groups of three bytes, which become four characters. When the input isn't a multiple of three bytes, one or two = characters pad the last group. The padding carries no information, which is why URL-safe forms often omit it.

Why is the encoded output about a third bigger?

Every three bytes become four characters, so the output is roughly 4/3 the size of the input. That's the price of using only safe text characters, and it's why embedding large files as Base64 in HTML or CSS isn't free.

Why does my decoded output look like garbage?

Not everything Base64 carries is text. An image, a compressed file or a cryptographic key decodes to arbitrary bytes. When the result isn't valid UTF-8, this tool shows the bytes in hexadecimal and says so, rather than displaying replacement characters.

Is Base64 a way to hide or protect data?

No. It's trivially reversible and provides no confidentiality. HTTP Basic authentication, for example, sends username:password as Base64, which is only safe because the connection itself is encrypted.

Can I decode a JWT here?

Each of a JWT's first two segments is Base64URL-encoded JSON, so you can decode them here one at a time. The JWT decoder does all of it in one step and also reads the expiry.

JWT Decoder — Read a token’s header and payload, and see when it expires.
X.509 Certificate Decoder — Paste a PEM certificate or chain: subject, names, expiry, fingerprints.
UUID & Hash Generator — Generate v4 UUIDs, or SHA-1/256/384/512 hashes of any text.
Format Identifier — Paste anything to find out what it is (a JWT, JSON, a certificate, Base64, a cron schedule and more), then open it in the right tool.