Base64 Encoder & Decoder
Text or files to Base64 and back, including the URL-safe variant and data URIs.
Encoding and decoding happen in this page. Nothing is uploaded, which matters when the string is an auth header or a token.
How it works
Base64 turns arbitrary bytes into text that survives systems which only handle text. Three bytes become four characters from a 64-symbol alphabet, so the output is always exactly a third larger than the input — which is the single most important thing to know about it, because people routinely embed images this way and are surprised when the page grows.
It is an encoding, not encryption. Anything Base64 can hide, anyone can reveal in one step. It appears in HTTP Basic authentication headers, which is precisely why Basic auth without TLS transmits credentials in what amounts to plain text.
The URL-safe variant exists because <code>+</code> and <code>/</code> are meaningful in URLs and file paths — <code>+</code> becomes a space when a query string is decoded, and <code>/</code> splits a path. Swapping them for <code>-</code> and <code>_</code> fixes both. JSON Web Tokens use this variant with the padding stripped, which is why a JWT segment pasted into a standard decoder often fails until you add the <code>=</code> back.
Padding itself carries no information: the length alone determines how many bytes the final group holds. It exists so that concatenated Base64 streams can be told apart, and most decoders accept it missing.
Encoding a file here produces a data URI as well as the raw Base64, which is what you want for embedding a small icon or font directly in CSS or HTML. Keep it small — a data URI cannot be cached separately from the document that contains it, so a large one is re-downloaded on every page load and blocks the render while it parses.
Common questions
Is Base64 a way of hiding something?
No. It is a text representation of bytes and it is reversible by anyone in a single step. It offers no confidentiality whatsoever — if the content is sensitive, it needs encrypting before it is encoded.
Why did my JWT fail to decode?
JWTs use the URL-safe alphabet with padding stripped. Switch the alphabet above to URL-safe and it will decode. The JWT decoder on this site handles all three segments at once and reads the claims properly.
How much bigger does it get?
Exactly four characters for every three bytes, so 33% larger, plus any line breaks. A 100 KB image becomes about 133 KB of text.
My decoded text is full of question marks.
The bytes are probably not text. Base64 encodes arbitrary binary, and interpreting a PNG or a zip as UTF-8 gives you nonsense. Decode it to a file instead.