Base64 Encoder/Decoder
Encode and decode Base64 in your browser, including URL-safe Base64 and UTF-8 text. Handles files and data URIs locally with nothing uploaded.
Last reviewed by the Radiatus Cloud team
Need this handled by experts?
Radiatus runs VAPT, managed SOC & security engineering for regulated teams.
What Base64 is for
Base64 represents binary data using 64 printable ASCII characters so it can travel through channels that only handle text: email bodies, JSON string fields, HTTP headers, XML documents and data URIs. It is an encoding, not encryption. Anyone can decode it instantly, so it provides no confidentiality whatsoever.
The size cost
Base64 turns every three bytes into four characters, so the output is about 33 percent larger than the input, plus padding. That trade is worth it for a small inline image or a certificate embedded in a config file. It is a poor choice for large payloads: a 5 MB image becomes roughly 6.7 MB and, unlike a binary upload, cannot be streamed efficiently.
Standard versus URL-safe
Standard Base64 uses + and / as its final two characters and = for padding. All three are awkward in URLs: + is read as a space in query strings and / is a path separator. URL-safe Base64, defined in RFC 4648, substitutes - and _ and usually drops the padding. JSON Web Tokens use it, which is why a JWT segment pasted into a standard decoder often fails. This tool detects which variant it has been given.
Unicode is the usual bug
Base64 encodes bytes, not characters, so text must first be converted to bytes with an explicit encoding. In JavaScript the legacy btoa function throws on any character above U+00FF, which is why encoding an emoji or an accented name fails. The correct approach is to encode the string to UTF-8 bytes and Base64 those. This tool does that, so non-Latin text round-trips correctly.
Data URIs
A data URI embeds the encoded bytes directly in a document with a MIME type prefix, avoiding a network request. That is a genuine win for a small icon or an inline SVG. Past a few kilobytes it becomes counterproductive: the data cannot be cached separately, it bloats the HTML or CSS carrying it, and it delays rendering of that document.
Local only
Encoding and decoding happen in your browser. Base64 blobs routinely contain certificates, service account keys and API credentials, so pasting one into a remote service is a credential disclosure.
Related tools
- Password Strength Checker — Measure password strength by entropy and pattern analysis rather than character-class rules. Checked entirely in your browser.
- Password Generator — Generate strong random passwords and passphrases in your browser using the Web Crypto API. Nothing is transmitted, logged or stored.
- Hash Generator — Generate MD5, SHA-1, SHA-256 and SHA-512 hashes in your browser. Compare checksums and verify file integrity with nothing uploaded to a server.
- JWT Decoder — Decode JWT header and payload, inspect claims and expiry, and spot common security flaws. Runs locally, your tokens are never transmitted.
Frequently Asked Questions
Is Base64 encryption?
No. It is a reversible encoding with no key and no secret. Anyone who sees the string can decode it instantly. Never use it to protect passwords, tokens or personal data. Its purpose is safe transport of binary data through text-only channels.
Why does my Base64 string fail to decode?
Usually a URL-safe string with - and _ being fed to a standard decoder, missing padding, or whitespace and line breaks introduced when copying from an email or PEM file. This tool detects the variant and tolerates whitespace.
What is URL-safe Base64?
A variant from RFC 4648 that replaces + with - and / with _, and usually omits the = padding, so the result is safe in URLs and filenames. JSON Web Tokens use it, which is why a JWT segment often fails in a standard decoder.
How much larger does Base64 make my data?
Roughly 33 percent, since every three bytes become four characters, plus up to two padding characters. Compression recovers some of that for text-like input but not for already-compressed data such as JPEG or PNG.
Why does encoding emoji or accented text fail elsewhere?
Base64 operates on bytes, not characters, and JavaScript's legacy btoa throws on any code point above U+00FF. The fix is to encode the text as UTF-8 bytes first, then Base64 those bytes. This tool does that automatically.
Privacy & Security
Processing happens in your browser.
How to Use
Paste text or Base64 string, then click Encode or Decode.
Disclaimer: This tool is provided "as is" without warranty of any kind. Results are for educational and utility purposes.
Related Tools
Password Strength Checker
SecurityMeasure password strength by entropy and pattern analysis rather than character-class rules. Checked entirely in your browser.
Password Generator
SecurityGenerate strong random passwords and passphrases in your browser using the Web Crypto API. Nothing is transmitted, logged or stored.
Hash Generator
SecurityGenerate MD5, SHA-1, SHA-256 and SHA-512 hashes in your browser. Compare checksums and verify file integrity with nothing uploaded to a server.