Base64 Encoder/Decoder
Encode and decode any text, URL, or binary data instantly with premium options. Supports Standard RFC 4648, URL-Safe base64url, Hex-to-Base64 cross-conversions, direct drag-and-drop file encoding/decoding, batch line conversion, and visual bit-level mathematical mathematical explanations.
Encode and decode any text, URL, or binary data instantly with premium options. Supports Standard RFC 4648, URL-Safe base64url, Hex-to-Base64 cross-conversions, direct drag-and-drop file encoding/decoding, batch line conversion, and visual bit-level mathematical mathematical explanations.
This developer tool is built with a privacy-first mindset. All transformations, formatting, and operations execute entirely in your local browser sandbox without transmitting sensitive tokens, keys, or code to external servers.
Base64 is a binary-to-text encoding scheme that converts binary data into a string of 64 printable ASCII characters — the uppercase letters A–Z, lowercase letters a–z, digits 0–9, plus (+), and slash (/), with equals signs (=) used as padding. The name comes directly from the 64-character alphabet it uses. It is not encryption — it is encoding. Anyone with a Base64 string can decode it back to the original data without any key or password.
The reason Base64 exists is a practical one: many systems and protocols were designed to handle text but not arbitrary binary data. Email protocols (SMTP), HTML data URIs, HTTP headers, JSON payloads, and XML documents all have this constraint. Base64 solves the problem by representing binary content — images, audio files, certificates, cryptographic keys — as a string that these text-only systems can safely transmit and store without corruption.
There are two common variants. Standard Base64 uses + and / characters, which can cause problems in URLs because those characters have special meaning in query strings. URL-safe Base64 (also called Base64url) replaces + with - and / with _ so the encoded string can be safely used in URLs and filenames without percent-encoding. JWT tokens, for example, use the URL-safe variant for all three of their sections.
This tool does two things: it encodes any text or binary input into its Base64 representation, and it decodes any Base64 string back into the original plain text. Both operations happen instantly in your browser the moment you click Encode or Decode — no server involved, no network request made.
For encoding, paste any plain text string, URL, JSON payload, or raw binary content into the input field and click Encode to Base64. The tool produces the standard Base64 output using the full 64-character alphabet with = padding where required. This is the format expected by email attachments, HTML data URIs, HTTP Basic Auth headers, and most API integrations that embed binary data in JSON or XML.
For decoding, paste any Base64 string and click Decode Base64 to get back the original content as readable text. The tool handles both standard Base64 (with + and /) and URL-safe Base64 (with - and _) automatically, so you do not need to know which variant your input uses. If the input is not valid Base64, the tool will flag the error immediately rather than silently producing garbled output.
Step 1
Type or paste your input into the Source Text field — this can be any plain text string, a URL, a JSON payload, an HTTP header value, or any other text content you want to encode or decode. If you want to see a quick example first, click Load Example to populate the field with sample data.
Step 2
To encode: click the Encode to Base64 button — the tool immediately converts your input into its Base64 representation. The output uses standard Base64 with A–Z, a–z, 0–9, +, and / characters, with = padding added at the end if needed to make the total length a multiple of 4.
Step 3
To decode: paste a Base64 string into the input field and click Decode Base64 — the tool converts it back to the original plain text. It automatically handles both standard Base64 (with + and /) and URL-safe Base64 (with - and _) so you do not need to pre-process your input.
Step 4
Copy the output using the copy button next to the result field — the encoded or decoded string is copied to your clipboard ready to paste into your code, API request, configuration file, or wherever you need it.
Step 5
If the tool shows an error after decoding, your input is likely not valid Base64 — check for missing padding characters (the = signs at the end), spaces or line breaks in the middle of the string, or characters outside the Base64 alphabet. The most common cause is a partially copied string that got cut off.
Base64 comes up constantly in day-to-day development, often in places you would not expect. HTTP Basic Authentication encodes credentials as Base64 in the Authorization header — the string Basic dXNlcjpwYXNzd29yZA== that you see in API requests decodes to user:password. Embedding a small icon or font directly in a CSS file as a data URI saves an HTTP request and uses Base64. Environment variables in CI/CD pipelines often carry Base64-encoded certificates, keys, or config files because newlines in multi-line values break most shell parsers. Every time I debug an authentication header or inspect a data URI, this is the first tool I reach for.
The privacy consideration is real too. Base64 strings frequently carry sensitive content — API credentials in Authorization headers, private key material in PEM files, personal data embedded in tokens. Using an online tool that sends your input to a server means that content passes through infrastructure you do not control. This tool decodes in your browser using the native JavaScript atob() and btoa() functions — your data is never transmitted anywhere.
Speed matters for a tool like this. I have used Base64 decoders that add a loading spinner for a two-second round trip to their server just to run a one-line JavaScript function. This tool is instant because it skips the server entirely. Paste, click, done — the result is in the output field before you can move your hand off the mouse.
100% browser-based — your text and binary data is encoded and decoded locally using native JavaScript functions and is never transmitted to any server
Supports both standard Base64 and URL-safe Base64 — handles + / and - _ variants automatically without requiring you to pre-process your input
Instant results — encoding and decoding happen in milliseconds using the browser's built-in atob() and btoa() functions with no server round-trip
Handles large inputs — efficiently processes text and data up to several megabytes without freezing the browser
Privacy-safe for sensitive data — ideal for inspecting Base64-encoded credentials
API keys
certificates
and tokens without third-party risk
Clear error reporting — invalid Base64 input is flagged immediately with a specific error rather than silently producing garbled output
No installation or account required — open the tool and start encoding or decoding immediately in any modern browser
Works offline after initial page load — useful in restricted network environments or when working without reliable internet access
Decoding HTTP Basic Auth headers to inspect encoded credentials
Encoding images or fonts as data URIs for embedding directly in CSS or HTML
Decoding Base64-encoded environment variables in CI/CD pipelines
Inspecting Base64-encoded sections of JWT tokens
Encoding API keys or credentials for transmission in Authorization headers
Decoding Base64 content in email MIME attachments
Converting binary certificate or key data to Base64 PEM format
Debugging Base64-encoded configuration values in Kubernetes secrets or Docker environment files
Example Input
Encode input: Hello, LearnHubly! This is a Base64 encoding test. Decode input: SGVsbG8sIExlYXJuSHVibHkhIFRoaXMgaXMgYSBCYXNlNjQgZW5jb2RpbmcgdGVzdC4=
Example Output
Encoded: SGVsbG8sIExlYXJuSHVibHkhIFRoaXMgaXMgYSBCYXNlNjQgZW5jb2RpbmcgdGVzdC4= Decoded: Hello, LearnHubly! This is a Base64 encoding test.
Invalid Base64 Characters: The input string contains characters not in the Base64 alphabet (A–Z, a–z, 0–9, +, /, =). Check for spaces, line breaks, or special characters that got included when copying — these are the most common cause of invalid character errors.
Incorrect Padding: Base64 strings must have a total length that is a multiple of 4, with = characters added at the end to pad to that length. A string missing its padding will fail to decode — try adding one or two = characters at the end and decode again.
Encoding Mismatch: Decoding a string that was never Base64-encoded produces garbled output. Verify that the string you are trying to decode is actually Base64 — valid Base64 strings only contain letters, numbers, +, /, and = characters.
URL-safe vs Standard Confusion: URL-safe Base64 uses - and _ instead of + and /. If your decoder produces errors or wrong output, check whether your input uses the URL-safe variant and ensure the tool is handling it correctly — this tool auto-detects both variants.
Truncated Input: If you copied a Base64 string from a log, a database field, or a terminal output that wraps long lines, the string may have been cut off. A truncated Base64 string will always fail to decode correctly — go back to the original source to get the complete string.
⚠Thinking Base64 is encryption
Best Practice: Base64 is encoding, not encryption. It provides zero security. Anyone who has the Base64 string can decode it back to the original data instantly without any key or password. Never use Base64 alone to protect sensitive data — use proper encryption like AES for data at rest or TLS for data in transit. Base64 is for safe transmission of binary data through text-only systems, nothing more.
⚠Using standard Base64 in URLs without checking for + and / characters
Best Practice: The + and / characters in standard Base64 have special meaning in URLs — + means a space and / is a path separator. If you embed a standard Base64 string in a URL query parameter without encoding it, the server will misinterpret the value. Always use URL-safe Base64 (which replaces + with - and / with _) for anything going into a URL, or percent-encode the standard Base64 string before appending it to a query string.
⚠Encoding already-encoded data a second time
Best Practice: Double-encoding happens when you Base64-encode a string that was already Base64-encoded, producing a string like U0dWc2JHOD0= that decodes to SGVsbG8= instead of Hello. Before encoding, check whether your input already looks like Base64 — if it only contains letters, numbers, + / and = and the length is a multiple of 4, it may already be encoded. Decode it first to check.
⚠Copying Base64 strings that have line breaks inserted
Best Practice: The MIME standard for email attachments inserts a line break every 76 characters in Base64 output. If you copy Base64 from an email source, a PEM certificate file, or a terminal that wraps long lines, those line breaks will cause decoding to fail in tools that expect a continuous string. Remove all whitespace and newlines from the string before pasting it into the decoder.
⚠Using Base64 to store passwords or secret keys in code
Best Practice: Base64-encoded secrets in source code are just as exposed as plain text secrets — they are trivially decoded in seconds. Developers sometimes Base64-encode API keys or passwords thinking it provides obfuscation, but any developer who reads the code can decode it immediately. Use environment variables, secrets managers (AWS Secrets Manager, HashiCorp Vault, GitHub Secrets), or a dedicated key management service to store sensitive credentials.
Git Cheatsheet
Quick reference guide for essential Git commands, branching workflows, remote repositories, stashing, and rollbacks.
Regex Cheatsheet
Interactive guide to Regex anchors, character classes, quantifiers, lookarounds, capturing groups, and search flags.
HTTP Headers Cheatsheet
Complete guide to standard and security HTTP headers including Authorization, CORS control, caching policies, and CSP directives.
SQL Cheatsheet
Complete guide to SQL statements including SELECT queries, WHERE filters, aggregate functions, JOIN types, and DDL commands.
Is Base64 a form of encryption?
No. Base64 is encoding, not encryption. Encryption requires a key and produces output that cannot be reversed without that key. Base64 is fully reversible by anyone — no key, no password, no special knowledge required. It exists purely to allow binary data to be safely transmitted through systems that only handle text. Never rely on Base64 to protect sensitive information.
Can I encode images with this tool?
You can paste the raw binary data of an image to get its Base64 representation, though for image files it is more practical to use a tool that accepts file uploads directly. The most common use case for Base64-encoded images is embedding small icons, logos, or background images directly in CSS as data URIs — for example background-image: url('data:image/png;base64,iVBOR...') — which eliminates a separate HTTP request for the image file.
Is there a limit to the data size?
The tool handles up to several megabytes of data efficiently. For very large inputs — anything over 10MB — performance depends on your device hardware, but typical use cases like encoding a certificate, a JSON payload, an API credential, or a small image are handled instantly. Base64 encoding increases data size by approximately 33% because every 3 bytes of input becomes 4 characters of output.
What is the difference between Base64 and Base64 URL-safe?
Standard Base64 uses + and / as the 62nd and 63rd characters of its alphabet. These characters have special meaning in URLs — + is interpreted as a space and / as a path separator — which causes problems when Base64 strings appear in URLs or filenames. URL-safe Base64 (Base64url) replaces + with - and / with _ to produce strings that are safe to use in URLs without percent-encoding. JWT tokens use the URL-safe variant for all three sections.
Is my data safe when using this tool?
Yes. All encoding and decoding is done locally in your browser using the native JavaScript btoa() and atob() functions. Your input data is never sent to any server, never logged, and never stored. This is particularly important when you are working with Base64-encoded credentials, API keys, private certificates, or any other sensitive content that you need to inspect or convert.
Why does Base64 output end with one or two equals signs?
The = characters at the end of a Base64 string are padding. Base64 encodes 3 bytes of input into 4 characters of output. If the input length is not a multiple of 3, the last group has fewer than 3 bytes, and = characters are appended to pad the output to a multiple of 4 characters in length. One = means the last group had 2 bytes, two == means it had 1 byte. The padding is required by the standard, though some implementations omit it.
How do I decode a Base64 string in JavaScript, Python, or Java?
In JavaScript use atob('your_base64_string') to decode or btoa('your_text') to encode. In Python use import base64 then base64.b64decode('your_base64_string') to decode or base64.b64encode(b'your_text') to encode. In Java use Base64.getDecoder().decode('your_base64_string') or Base64.getEncoder().encodeToString(bytes). For URL-safe Base64, use base64.urlsafe_b64decode in Python or Base64.getUrlDecoder() in Java.
Why does decoding my Base64 string produce garbled output?
The three most common causes are: first, the string was never actually Base64-encoded — it just happens to look like it contains valid characters. Second, the string uses URL-safe Base64 with - and _ but your decoder expects standard Base64 with + and / — try swapping them manually before decoding. Third, the string was double-encoded — Base64-encoded twice — in which case you need to decode it twice to get back the original content.
What is Base64 Encoding? How It Works, Uses & Examples (2026 Guide)
What is Base64 Encoding? How It Works, Uses & Examples (2026 Guide). Complete explanation with code examples, Base64URL, real-world use cases, and differences from encryption and hashing.
How to Encode and Decode Data Online – Complete Guide 2026 | Expert Insights
Learn how to encode and decode data online with Base64, URL Encoding, and HTML Encoding. Expert guide with real-world insights from a Principal Software Engineer with 15+ years of experience. Free online tools included.
Related Developer Tools
Discover more fast, browser-based utilities in the Encoders suite.
Recently Visited Tools
No recent tools visited yet. Explore tools above to build your quick-access history.