Base64 Encoder / Decoder

About this Base64 Encoder / Decoder

The Base64 Encoder / Decoder converts text to the Base64 representation commonly used for transporting binary-style data through text-based systems. Base64 is an encoding format, not encryption, so encoded content should not be considered secret.

Base64 encoding converts binary or text data into a text-safe format using only 64 printable characters, which is why it's commonly used to embed images directly in HTML/CSS, attach files in email, and safely transmit binary data through systems designed to handle plain text.

For related tasks, try URL Encoder / Decoder, HTML Entity Encoder / Decoder or Caesar Cipher Encoder / Decoder.

How to use it

1. Paste plain text to encode or Base64 text to decode.
2. Choose the required action.
3. Copy the converted result from the text box.

Practical example

The plain text “Hello” encodes to “SGVsbG8=”. Decoding that Base64 value returns “Hello”.

The plain text Hello encodes to SGVsbG8= in Base64, and that trailing equals sign is padding, added when the original data length isn't a clean multiple of 3 bytes, which is a normal and expected part of correct Base64 output.

Things to double-check

Base64 is an encoding scheme, not an encryption method, so encoded text is not secure or hidden from anyone who knows it's Base64; it can be decoded instantly by anyone using this same tool or countless others, so never use Base64 alone to protect sensitive information.

How Base64 works

Base64 turns binary data into text using 64 safe characters: A to Z, a to z, 0 to 9, plus and slash. Every 3 bytes become 4 characters, so the encoded text is about one third larger than the original. The text Hello becomes SGVsbG8=, where the equals sign is padding added when the input does not divide evenly into groups of three. Decoding reverses the process exactly, which makes Base64 a safe way to carry binary data through systems that only handle text.

Where you meet it

Base64 appears in email attachments, data URIs that embed small images directly in HTML or CSS, and the parts of a JSON Web Token. A URL-safe variant replaces plus and slash with minus and underscore so the result can sit inside a link. The HTTP Basic authentication header contains a Base64 string of username and password joined by a colon. Because anyone can decode it, that header is only safe over an encrypted HTTPS connection.

It is encoding, not encryption

Base64 does not hide anything. It is a reversible format with no key, and anyone can decode it in seconds. Never treat a Base64 string as protection for passwords, tokens or personal data. If you need to protect information, use proper encryption and secure storage. When you see a long string that ends with equals signs in a configuration file, remember that it may contain readable secrets once decoded.

Text, Unicode and errors

Text characters outside plain English letters, such as Urdu script or emoji, must first be converted to bytes, usually with UTF-8, before they can be encoded. If you decode and get strange symbols, the original text may have used a different character set. Decoding fails when the input contains characters outside the Base64 alphabet or has been truncated. Remove line breaks and spaces, and check that the length is a multiple of four once padding is included.

Data URIs and the size cost

A data URI embeds a file in a web page as text, in the form data colon, the file type, base64 and then the encoded content. It saves a network request, which is useful for tiny icons. Encoding adds about a third to the size, so a 3 KB icon becomes about 4 KB. Large images embedded this way make the page heavier and cannot be cached on their own, so they usually slow a site down. Use data URIs only for small assets, and serve larger images as normal files.

Worked example: encoding by hand

Take the text Hi!, which is three characters. In bytes it is 72, 105 and 33, which in binary is 01001000, 01101001 and 00100001. Join the 24 bits and cut them into four groups of six: 010010, 000110, 100100 and 100001. These are the numbers 18, 6, 36 and 33. Looking them up in the Base64 alphabet, where 0 to 25 are A to Z, 26 to 51 are a to z, 52 to 61 are the digits, and 62 and 63 are plus and slash, gives S, G, k and h, so Hi! becomes SGkh. When the input is not a multiple of three bytes, padding with equals signs completes the last group.

Where Base64 shows up

Base64 is used wherever binary data has to pass through a channel designed for text. Email attachments use it, along with line breaks every 76 characters. Data URIs embed small images in web pages. JSON Web Tokens use a URL-safe variant of Base64 for each of their parts, so the header of a typical token begins with eyJhbGciOiJIUzI1NiIs, which decodes to a small piece of JSON naming the algorithm. API keys and certificates in text form are often Base64 too. Recognising the pattern, letters and digits ending in equals signs, helps when you inspect configuration files and network traffic.

Security: encoded is not protected

Because anyone can decode Base64, treat an encoded value as plain text. HTTP Basic authentication sends the username and password as Base64, which is safe only over an encrypted connection. Secrets committed to a code repository in Base64 are as exposed as secrets in plain text, and attackers search public repositories for them. If a token or key has been exposed, rotate it. Use proper encryption and a secrets manager for sensitive values, and use Base64 only for what it is designed to do: represent bytes as text.

Variants and troubleshooting

Several variants exist. The URL-safe form replaces plus and slash with minus and underscore and often drops the padding. MIME adds line breaks. If decoding fails, check for stray spaces, missing padding, characters from the wrong variant or a truncated string. Text with accents or non-Latin letters must be converted to bytes, usually as UTF-8, before encoding, and decoded the same way, or you will see garbled symbols. In JavaScript, the built-in btoa function handles only simple characters, so Unicode text needs an extra step before it is encoded.

Key terms explained

Encoding converts data from one form to another for transport or storage, and it can be reversed by anyone who knows the scheme. Encryption protects data with a secret key. A byte is eight bits, and Base64 maps every three bytes to four printable characters. Padding uses equals signs to complete the last group. Base64url is a variant for web addresses. MIME is the standard for email attachments. A data URI embeds a file inside a page, and UTF-8 is the character encoding for text.

Rules of thumb and quick checks

Base64 output is about 33 percent larger than the input, and its length is always a multiple of four with padding. A string with only letters, digits, plus, slash and trailing equals signs is probably Base64. One byte gives two characters and two equals signs, two bytes give three characters and one equals sign. If decoding fails, remove spaces, check the variant and confirm that no characters were lost. Never rely on Base64 to hide secrets.

Frequently asked questions