Base64 Encode and Decode
Convert text to Base64 and back. Handles full UTF-8 correctly, including emoji and non-Latin scripts, and can produce URL-safe output for query strings and JWT segments. Everything runs in your browser — nothing is uploaded.
How it works
What Base64 actually does
Base64 maps every three bytes of input onto four printable ASCII characters, drawn from A–Z, a–z, 0–9, + and /. Because four characters carry three bytes, Base64 output is about 33% larger than its input. When the input length isn't divisible by three, = padding fills the gap.
It is an encoding, not encryption. Anyone can decode it instantly — as this page does. Never use it to hide a secret.
URL-safe Base64
The standard alphabet includes + and /, which have meaning inside URLs, and =, which is awkward in query strings. URL-safe Base64 (RFC 4648 §5) substitutes - for + and _ for /, and usually drops the padding. This is the form used in JWT headers and payloads.
Decoding on this page accepts either alphabet and restores missing padding automatically, so you can paste a JWT segment directly.
UTF-8 and non-ASCII text
Base64 encodes bytes, not characters, so text must be turned into bytes first. This tool uses UTF-8, which is what essentially every modern system expects. That means emoji, accented characters, Arabic, Chinese and Cyrillic all round-trip correctly.
A common bug elsewhere is using a byte-per-character shortcut, which corrupts anything outside ASCII. If another tool gave you mangled output for non-English text, that's usually why.
What people use it for
- Decoding a JWT to read its header or payload — paste the segment between the dots.
- Embedding a small image or font in CSS or HTML as a
data:URI. - Reading a Base64 field from a Kubernetes secret, an API response or a config file.
- Encoding credentials for a Basic auth header, which expects
user:passwordin Base64. - Moving binary data through a text-only channel — a log line, a JSON string, an email body.
Nothing is uploaded. This tool runs entirely in JavaScript in your browser. Your input is never sent to a server, never logged and never stored, and no account is required. Once the page has loaded you can go offline and it still works — open your browser's network tab and watch if you'd like to confirm it.
Frequently asked questions
Is Base64 encryption?
No. Base64 is a reversible encoding with no key and no secret. Anyone can decode it in a second, exactly as this page does. It protects nothing — use it for transport, never for confidentiality.
Why does my decoded text look like gibberish?
Usually the input wasn't Base64 to begin with, or it was truncated. Base64 input length should be a multiple of four once padding is added. It can also mean the original bytes weren't UTF-8 text at all — for example a compressed or encrypted blob, which has no readable form.
What is the = at the end?
Padding. Base64 works in three-byte groups; when the final group is short, one or two = characters mark the gap. URL-safe Base64 often omits padding, and this tool restores it for you when decoding.
Can I encode a file?
Not in this version — this tool works on text. For a file, use base64 file.png on Linux or macOS, or certutil -encode file.png out.txt on Windows.
Is my input sent to a server?
No. Encoding and decoding happen in JavaScript in your browser. Nothing is uploaded or logged, which matters when the thing you are decoding is a token or a secret.
Tools that run where your code is
This page does its work in your browser because sending your data to a server to process it is a bad default. Catalase applies the same idea to AI coding: a free, open-source code editor that runs language models on your own machine through Ollama, with no account and no telemetry. Cloud models are there when you choose one, not by default.
Related tools
- JWT decoder — Decode a token's header and payload without pasting it into a remote site.
- URL encode / decode — Percent-encoding for query strings and paths.
- Hash generator — SHA-256 and SHA-1 digests, computed locally.