Base64 encoder and decoder

What this tool does

Base64 is a way of writing any data, text or binary, using only 64 safe characters: the letters, the digits, plus and slash. It exists because many systems that carry data, such as email, JSON, URLs and HTML attributes, can only be trusted with plain text. This tool converts in both directions. Encode takes text you type or a file you open, and Decode takes Base64 and gives back the text, or the file when it is not text. Everything happens in your browser, so a private key, a token or a document is never uploaded.

How to use it

1. Choose Encode or Decode.
2. Type or paste, or press "Open a file", or drop a file on the page. The result appears as you type.
3. Copy the result or download it. "Use as input" moves the result to the other tab, which is a quick way to check a round trip.

When you decode, you do not need to clean the text first. White space and line breaks are ignored, a missing = at the end is added, the URL-safe letters - and _ are accepted, and a whole data: URI is unwrapped. The tool says which of these it did. If the text really is not Base64 it tells you which character is wrong and where.

UTF-8 and the accent trap

Base64 encodes bytes, not letters, so text must first become bytes. This tool uses UTF-8, the encoding of the web. The word café is the five bytes 63 61 66 c3 a9, and its Base64 is Y2Fmw6k=. A common bug is to feed such text to the browser's old btoa function, which treats every character as a single byte: it gives Y2Fm6Q== for the same word, which other systems decode as a broken "caf" followed by an invalid byte, or refuses outright for characters like Việt or emoji. The text "Hello, Việt Nam! 😀 café" encodes here as SGVsbG8sIFZp4buHdCBOYW0hIPCfmIAgY2Fmw6k= and decodes back unchanged.

Standard, URL-safe, padding and line length

• Standard uses + and /. Both have a meaning in a URL, so for a URL, a file name or a JWT, pick URL-safe, which writes - and _. The bytes fb ff fe ff are +//+/w== in standard Base64 and -__-_w== in the URL-safe form.
• Padding adds = so the length is a multiple of four. Many URL-safe uses, including the three parts of a JWT, leave it out; switch it off for that. The header {"alg":"HS256","typ":"JWT"} is eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9, with no padding needed.
• Line length breaks the output into lines of 64 characters (PEM, used in certificates and keys) or 76 (MIME, used in email attachments). Leave it at one line for everything else.

Files, images and data URIs

Open any file to encode it; the size limit is 20 MB. Turn on As a data: URI to get a ready-to-paste value such as data:image/png;base64,iVBOR…, which you can use as an <img> source or a CSS url(). This is handy for a small icon, but it makes the data a third larger and the browser cannot cache it separately, so for anything over a few kilobytes a normal file is better; the image toolkit can shrink a picture first. When you decode a Base64 text that turns out to be an image, you see a preview, and anything that is not text, such as an image, a PDF or a ZIP, is offered as a download with the right extension instead of being shown as garbage.

Good to know

• Base64 is not encryption. Anyone can decode it, so never use it to hide a secret. To check that a file is unchanged, use the file hash checker.
• It makes data larger. Every 3 bytes become 4 characters, about 33% more; 1000 bytes become 1336 characters including padding.
• To make a JSON value readable after decoding, paste it into the JSON formatter.