How to encode or decode Base64
- Choose Encode or Decode, and whether you are working with Text or a File.
- To encode text, type or paste it; the Base64 appears on the right as you type. Tick URL-safe for Base64 that will go into a URL or a JWT, and Omit padding if the receiving system does not want trailing = signs.
- To encode a file, drop it onto the box. Tick Output as data URL to get a string such as data:image/png;base64,… that can be pasted into HTML or CSS.
- To decode, paste Base64 — line breaks, spaces, missing padding and a data: prefix are all fine. Text is shown directly; anything else (an image, a PDF, a ZIP) is detected, previewed if it is an image, and offered as a download.
How Base64 works
Base64, defined in RFC 4648, turns any bytes into plain letters, digits and two symbols, so binary data can travel through systems designed for text: email, JSON, URLs, HTML. It takes the input three bytes (24 bits) at a time and splits them into four groups of six bits. Each six-bit value, from 0 to 63, is written as one character of the alphabet A–Z, a–z, 0–9, + and /.
When the input length is not a multiple of three, the last group is padded: one leftover byte becomes two characters plus ==, two leftover bytes become three characters plus =. That is why Base64 output is always about a third larger than the input — every 3 bytes become 4 characters.
Text is encoded as UTF-8 first
Base64 encodes bytes, not letters, so text has to be turned into bytes first. This tool uses UTF-8, the encoding used by the web and nearly every modern system. The browser's built-in btoa function only accepts characters up to U+00FF and throws an error on Chinese, emoji or most accented text; this tool does not have that limitation.
URL-safe Base64
The + and / characters have special meanings in URLs and file names. The "base64url" variant in section 5 of RFC 4648 replaces them with - and _, and often drops the padding. JSON Web Tokens use it. When decoding, this tool accepts either alphabet automatically.
Base64 is not encryption
Anyone can decode Base64 — there is no key. It hides nothing; it only changes the representation. Credentials in a Basic authentication header or data inside a JWT are Base64-encoded for transport, not protected by it.
Examples
| Input | Base64 |
|---|---|
f | Zg== |
fo | Zm8= |
foobar | Zm9vYmFy |
Hello, 世界 | SGVsbG8sIOS4lueVjA== |
Hello, 世界 (URL-safe, no padding) | SGVsbG8sIOS4lueVjA |
| bytes FB FF BF | +/+/ standard, -_-_ URL-safe |
The first three rows are test vectors from RFC 4648 itself. "Hello, 世界" is 13 bytes in UTF-8 — each Chinese character takes three — so it becomes 20 characters including the padding.
Decoding SGVsbG8 (without padding) gives "Hello". Decoding SGV*bG8 fails with a message pointing at character 4, the asterisk.
Limits
- Text encoding is UTF-8. Base64 created from text in another encoding (for example GBK or Windows-1252) decodes to bytes that are not valid UTF-8; the tool then treats them as binary and offers them as a file.
- Size. Files of tens of megabytes encode fine, but the resulting text is a third larger and very long strings make text boxes slow. For large files, download the result instead of copying it.
- Other variants. Base32, Base58 (Bitcoin addresses) and uuencode are different encodings and are not decoded here.
Frequently asked questions
Is Base64 encryption?
No. It is a reversible encoding without a key; anyone can decode it. Do not use it to protect secrets.
Why does my Base64 end with = or ==?
That is padding. It shows that the last group had only one or two bytes instead of three. Some systems omit it; this tool decodes either way.
Why is the Base64 bigger than the original?
Every 3 bytes become 4 characters, so Base64 is about 33% larger, plus a little for padding and any line breaks.
Can I decode a data URL?
Yes. Paste the whole data: URL; the prefix is removed automatically and images are previewed.
Is my data uploaded?
No. Encoding and decoding happen in your browser.