Encode text to Base64 or decode it back, instantly and privately. Full UTF-8 support, a URL-safe option, and one important guarantee: nothing you type ever leaves your browser. No server, no logging, no exceptions.
What is Base64?
Base64 is a way of representing binary data using only 64 printable ASCII characters: the letters A-Z and a-z, the digits 0-9, and two symbols (+ and /). A = is used for padding.
Why would you want that? Because some systems can only reliably handle text. Email, URLs, JSON, XML, HTML data attributes, these were all designed around text, not raw binary. Base64 lets you shove binary data (or any text) through a text-only channel without it getting mangled.
It’s not encryption. It’s not compression. It’s an encoding, a reversible transformation that anyone can decode. Never use Base64 to hide sensitive data. Use it to transport data safely.
Common uses for Base64
Data URIs in CSS and HTML
You can embed a small image directly in your CSS or HTML as a Base64 string, avoiding a separate HTTP request:
background-image: url( "data:image/svg+xml;base64,PHN2ZyB4bWxucz0i..." );Great for tiny icons and inline SVGs. Not great for large images: Base64 inflates the size by about 33%, so use it only where the saved request outweighs the added bytes.
HTTP Basic Authentication
The Authorization header for Basic Auth is just username:password Base64-encoded:
Authorization: Basic dXNlcjpwYXNzd29yZA==This is exactly why Basic Auth must only run over HTTPS. Base64 is trivially decoded, so over plain HTTP the credentials are effectively in the clear.
Encoding data in JSON and APIs
APIs often Base64-encode binary payloads (file uploads, images, cryptographic tokens) so they can travel inside JSON, which has no native binary type. JWTs (JSON Web Tokens) use URL-safe Base64 for each of their three segments.
Email attachments
The MIME standard uses Base64 to encode attachments so binary files survive the text-based journey through mail servers.
Standard vs URL-safe Base64
Standard Base64 uses + and /. Both of those characters have special meaning in URLs: + can mean a space, and / is a path separator. If you drop standard Base64 into a URL, it can break.
URL-safe Base64 solves this by swapping + for - and / for _.
Padding (=) is also often stripped in URL-safe contexts, since = is a query-string delimiter. The tool above handles all of this: check the URL-safe and Strip padding options when you’re encoding something destined for a URL, a filename, or a JWT.
The decoder accepts both standard and URL-safe input automatically, so you don’t have to know which variant you’re pasting in.
Base64 and character encoding
Here’s where a lot of online Base64 tools quietly fail: non-ASCII characters.
The naive JavaScript approach (btoa()) only handles Latin-1 characters. Feed it an emoji or a Chinese character and it throws an error or produces garbage. This tool handles the full UTF-8 range correctly: emoji, accented Latin, Cyrillic, CJK, everything. Encode café ☕ 世界, decode it back, and you get exactly what you put in.
If you’ve ever gotten mojibake (garbled characters) out of a Base64 tool, this is why, and why this one doesn’t do that.
Is Base64 secure?
No. And this matters enough to say plainly: Base64 is not encryption.
Anyone can decode a Base64 string in seconds. This very tool does it instantly, with no key required. If you Base64-encode a password, an API key, or any secret and store or transmit it thinking it’s protected, it isn’t. It’s the equivalent of writing something backwards and calling it a cipher.
Use Base64 to transport data through text-only channels. Use real encryption (and HTTPS) to protect data. They solve different problems.
One more note on privacy: because this tool runs entirely in your browser, anything you paste here stays on your machine. Nothing is sent to a server, so even encoding or decoding sensitive data here is safe from a transmission standpoint. But that guarantee is about this tool, not about Base64 as a format.