Home › Developer tools › Base64
Developer tool

Encode and decode Base64 — free, offline, no upload

Convert text to Base64 or turn Base64 back into readable text, with correct handling of accents, emoji and every other non-ASCII character. The conversion happens on this page — nothing is sent to a server.

Perfect for
An inline image inside a stylesheet An Authorization header you have to build Inspecting one segment of a JWT Encoding a value for a config file Decoding a payload copied out of a log
How to use it
1
Paste your textIt goes in the top box. The direction can be flipped at any time with the two buttons.
2
Choose the alphabetTick URL-safe to use - and _ instead of + and /, which is what URLs and filenames require.
3
Read the resultConversion is live as you type, so in the common case there is nothing to press.
4
Swap to check your workThe swap button sends the result back up and decodes it, which is the fastest sanity check on a round trip.

Direction

Replaces + and / with - and _, and drops the = padding. Use it for query strings, filenames and data URLs.

Tip: Base64 is encoding, not encryption. Anyone can reverse it, so never use it to conceal a password or a key.

What Base64 actually does

Base64 exists because some channels can only carry text. Email headers, URL query strings, JSON string values and XML documents are all text-only, so binary content has to be re-expressed in characters that every one of those systems agrees on. Base64 takes three bytes and maps them onto four characters drawn from a 64-character alphabet — A–Z, a–z, 0–9, plus and slash. That is why the output is always roughly a third larger than the input.

The 33% you always payThree bytes become four characters. Before padding, Base64 output is exactly one third larger than the source — the unavoidable cost of squeezing binary through a text channel.

Not encryption, and it matters that people think it is

Base64 is a reversible encoding with no key. Anyone holding the string can decode it in a single line of code, which is why “hidden” secrets in Base64 are a recurring class of security incident: credentials committed to a repository in Base64 are plain-text credentials with an extra step. If a value genuinely needs to be secret, it needs encryption with a key that never travels alongside it.

Why the URL-safe variant exists

The standard alphabet uses + and /. Both have a defined meaning inside a URL path, and = padding has one in query strings, so a standard Base64 value pasted into a URL can be silently altered in transit. The URL-safe variant swaps + for -, / for _, and usually drops the padding. That is the form used by JWTs, by many APIs and by anything that has to survive a filename.

Where UTF-8 fits in

Base64 operates on bytes, not characters. Text therefore has to be turned into bytes first — here via UTF-8 — and turned back afterwards. Naive implementations encode each JavaScript character code directly, which works for ASCII and produces mojibake for everything else. This page goes through the encoder and decoder explicitly, so accented letters, emoji and Chinese text survive a round trip intact.

Round-trip test: paste your text, copy the Base64, paste it back in, switch to Decode and press Swap. If you get your original text back, the conversion is correct — a check worth doing before you paste a value into a config file you are about to deploy.

Frequently asked questions

Is this Base64 converter free?
Yes. There is no sign-up, no quota and no watermark on the output. The site is supported by display advertising.
Is my text uploaded to a server?
No. Encoding uses the browser’s own btoa and decoding uses atob plus TextDecoder, both inside the page. Nothing is transmitted, which matters when the content is a credential or a private key.
Is Base64 a form of encryption?
No, and treating it as one is a real security mistake. Base64 is a reversible encoding with no key: anyone who has the string can decode it in one line of code. It hides nothing on its own.
Why is the output longer than the input?
Because three bytes become four characters. That is a 33% increase before padding, and it is the unavoidable cost of representing binary data using only printable text.
What is URL-safe Base64?
The standard alphabet uses + and /, and both have meanings inside a URL. The URL-safe variant replaces them with - and _ so the value survives a query string, a filename or a data URL unchanged.
Does it handle emoji and non-English text?
Yes. Text is converted to UTF-8 bytes before encoding and decoded back from UTF-8 afterwards, so accented letters, emoji and Chinese text all survive the round trip. Simplistic implementations produce garbled text at this point.
Can I decode a whole JWT with this?
Only one segment at a time. A JWT is three dot-separated parts, and its payload uses the URL-safe alphabet, so paste just the middle segment. A full token needs a dedicated decoder that splits it for you.