Base64 Encoder / Decoder
Convert text to Base64 encoding or decode Base64 back to text. All processing happens locally in your browser.
Updated July 11, 2026
100% Private & Secure
This tool runs in your browser.
Your data is never uploaded or stored.
How to use
- 1
Enter your text or Base64 string.
- 2
Click Encode or Decode.
- 3
Copy the result.
When to use it
Embedding binary assets in JSON or HTML
Small images, fonts, and PDFs can be inlined as data: URLs without a separate HTTP request. Base64 is the standard encoding for that payload, keeping everything self-contained.
Inspecting HTTP Basic Auth and JWT headers
A Basic Authorization header is the literal string user:pass Base64-encoded. Decoding it reveals the credentials — which is also why TLS is mandatory. JWTs use Base64URL (not standard Base64) for each of their three segments.
Transferring binary data through text-only channels
Email (MIME), JSON configs, and XML all choke on raw bytes. Base64 maps every 3 bytes onto 4 printable ASCII characters (A–Z, a–z, 0–9, +, /), so binary survives any 7-bit-clean transport.
Debugging a broken data URL or source map
When an inlined asset renders as garbage, decoding the Base64 chunk is the fastest way to tell whether the source was truncated, corrupted in transit, or encoded with the wrong variant.
How it works
What Base64 actually does
Base64 is a binary-to-text encoding defined by RFC 4648. It splits the input into 6-bit groups (26 = 64), so each group maps to one character in a 64-symbol alphabet: A–Z, a–z, 0–9, +, and /. Three input bytes (24 bits) always become four output characters.
Because the input length is rarely a clean multiple of three, the encoder pads the remainder with = — one = means the final group held two bytes, two = means it held one. Decoders reject or silently drop non-alphabet characters depending on strictness.
- Standard alphabet ends with
+ /— fine for MIME and JSON, unsafe inside a URL path segment - URL-safe variant swaps
+ /for- _and usually drops padding (RFC 4648 §5) - Output is ~33% larger than the input: 3 bytes become 4 characters
Base64 is encoding, not encryption
This is the single most common mistake. Base64 is reversible by anyone — it has no key, no salt, no secret. Encoding a password or token in Base64 protects it exactly as well as writing it in pencil: it obscures nothing from anyone who can read.
If you need confidentiality, use encryption (AES-GCM). If you need integrity, use a keyed hash (HMAC-SHA-256). Reach for Base64 only when the goal is transport compatibility — making binary data survive a channel that only accepts printable ASCII.
// "secret" in Base64 is just... readable:
atob('c2VjcmV0') // -> "secret" (anyone can do this)Base64 vs Base64URL, and the btoa/atob trap
The browser's btoa() and atob() implement the standard RFC 4648 alphabet — and they throw InvalidCharacterError on any character outside it, including raw bytes above U+00FF. That is why encoding UTF-8 text (emoji, CJK, accented letters) requires the TextEncoder → Uint8Array dance first.
For tokens that travel in URLs — JWTs, signed cookies, Data URLs — use the Base64URL variant, which replaces + and / with - and _ so they never need percent-encoding.
// UTF-8 safe encode:
const b64 = btoa(String.fromCharCode(...new TextEncoder().encode('café ☕')));
// -> 'Y2Fmw6kg4piV'
// Base64URL (for JWTs / URLs):
b64.replaceAll('+', '-').replaceAll('/', '_').replaceAll('=', '');Common mistakes & edge cases
"Failed to execute 'atob'... InvalidCharacterError"
The input contains whitespace, a newline, or a character outside the Base64 alphabet. Strip non-alphabet characters before decoding, or verify you are decoding the right variant.
Decoding UTF-8 text returns mojibake (é, 漢字, emoji break)
btoa/atob only handle Latin-1. Encode through TextEncoder first, or decode through TextDecoder — never pass multibyte strings directly to btoa.
A Base64 string works in code but breaks inside a URL
The standard alphabet uses + and /, both of which are reserved in URLs. Switch to Base64URL (- and _) and drop the trailing = padding.
The decoded output is truncated or padded with garbage bytes
Padding (=) was stripped or the string was cut mid-segment. Recalculate the correct length — Base64 length must be a multiple of 4 before decoding.