Replaces + and / with - and _, and drops the = padding. Use it for query strings, filenames and data URLs.
Tip: Base64 is encoding, not encryption. Anyone can reverse it, so never use it to conceal a password or a key.
Base64 exists because some channels can only carry text. Email headers, URL query strings, JSON string values and XML documents are all text-only, so binary content has to be re-expressed in characters that every one of those systems agrees on. Base64 takes three bytes and maps them onto four characters drawn from a 64-character alphabet — A–Z, a–z, 0–9, plus and slash. That is why the output is always roughly a third larger than the input.
Base64 is a reversible encoding with no key. Anyone holding the string can decode it in a single line of code, which is why “hidden” secrets in Base64 are a recurring class of security incident: credentials committed to a repository in Base64 are plain-text credentials with an extra step. If a value genuinely needs to be secret, it needs encryption with a key that never travels alongside it.
The standard alphabet uses + and /. Both have a defined meaning inside a URL path, and = padding has one in query strings, so a standard Base64 value pasted into a URL can be silently altered in transit. The URL-safe variant swaps + for -, / for _, and usually drops the padding. That is the form used by JWTs, by many APIs and by anything that has to survive a filename.
Base64 operates on bytes, not characters. Text therefore has to be turned into bytes first — here via UTF-8 — and turned back afterwards. Naive implementations encode each JavaScript character code directly, which works for ASCII and produces mojibake for everything else. This page goes through the encoder and decoder explicitly, so accented letters, emoji and Chinese text survive a round trip intact.