Base64 Encoder/Decoder

What Base64 is for

Base64 represents binary data using 64 printable ASCII characters so it can travel through channels that only handle text: email bodies, JSON string fields, HTTP headers, XML documents and data URIs. It is an encoding, not encryption. Anyone can decode it instantly, so it provides no confidentiality whatsoever.

The size cost

Base64 turns every three bytes into four characters, so the output is about 33 percent larger than the input, plus padding. That trade is worth it for a small inline image or a certificate embedded in a config file. It is a poor choice for large payloads: a 5 MB image becomes roughly 6.7 MB and, unlike a binary upload, cannot be streamed efficiently.

Standard versus URL-safe

Standard Base64 uses + and / as its final two characters and = for padding. All three are awkward in URLs: + is read as a space in query strings and / is a path separator. URL-safe Base64, defined in RFC 4648, substitutes - and _ and usually drops the padding. JSON Web Tokens use it, which is why a JWT segment pasted into a standard decoder often fails. This tool detects which variant it has been given.

Unicode is the usual bug

Base64 encodes bytes, not characters, so text must first be converted to bytes with an explicit encoding. In JavaScript the legacy btoa function throws on any character above U+00FF, which is why encoding an emoji or an accented name fails. The correct approach is to encode the string to UTF-8 bytes and Base64 those. This tool does that, so non-Latin text round-trips correctly.

Data URIs

A data URI embeds the encoded bytes directly in a document with a MIME type prefix, avoiding a network request. That is a genuine win for a small icon or an inline SVG. Past a few kilobytes it becomes counterproductive: the data cannot be cached separately, it bloats the HTML or CSS carrying it, and it delays rendering of that document.

Local only

Encoding and decoding happen in your browser. Base64 blobs routinely contain certificates, service account keys and API credentials, so pasting one into a remote service is a credential disclosure.