Base64 Encoder and Decoder

Base64 is a way of writing any binary data using only 64 safe characters: A–Z, a–z, 0–9, + and /, with = used as padding at the end. Every 3 bytes of input become 4 characters of output, so encoded data is about 33% larger than the original.

It exists because many systems, such as email, URLs, JSON, XML and HTTP headers, were designed for text and can corrupt raw binary data. Encoding it as Base64 lets it travel safely through them.

• Data URLs: embedding small images or fonts directly in HTML or CSS, e.g. data:image/png;base64,....
• Email attachments: MIME encodes attachments as Base64.
• HTTP Basic authentication: the Authorization header contains username:password in Base64.
• JSON Web Tokens (JWT): the header and payload are URL-safe Base64.
• APIs and config: passing certificates, keys or binary blobs inside JSON or environment variables.

Anyone can decode Base64 instantly, including with this tool. It hides nothing and provides no security. Never treat Base64-encoded passwords, tokens or personal data as protected. To check integrity, use a hash from the Hash Generator; to protect data, use real encryption such as AES with a secret key.

The browser's built-in btoa() function fails on any character outside Latin-1, so emoji and most non-English text cause errors in naive tools. This encoder first converts text to UTF-8 bytes, then encodes them, which matches what servers and programming languages expect.

URL-safe Base64 (used in JWTs and some APIs) replaces + with - and / with _, and often drops the = padding. The decoder accepts both forms automatically. To encode text for use in a URL query string, the URL Encoder is usually the better choice.

HTTP Basic authentication sends credentials as username:password encoded in Base64. For the username ada and password secret:

1. Join them with a colon: ada:secret.
2. Encode the result: YWRhOnNlY3JldA==.
3. Send the header Authorization: Basic YWRhOnNlY3JldA==.

This shows why Basic auth must only be used over HTTPS: anyone who sees the header can decode it straight back to the password.

Because Base64 adds about a third to the size of data, it is best for small payloads. Embedding a 3 KB icon as a data URL saves an extra network request; embedding a 300 KB photo makes your HTML or CSS much larger and stops the browser caching the image separately. As a rule of thumb, keep inline Base64 images under a few kilobytes.