Base64 is not encryption and it does not compress anything. Anyone who sees a base64 string can decode it in one line of code, and the encoded output is roughly a third larger than the original bytes because every three input bytes become four output characters. Treat it purely as a format conversion for moving binary data through text only channels, never as a way to hide or protect content.
The tricky part most tools get wrong is unicode. A naive implementation calls the browser's built in btoa function directly on a JavaScript string, which throws or silently corrupts anything outside the Latin1 range, such as an accented letter or an emoji. This tool encodes text through TextEncoder first, converting it to UTF-8 bytes before base64 ever sees it, so multi byte characters round trip correctly every time you encode base64 online here.
When to reach for this base64 encoder decoder
Base64 solves one specific problem: some transport or storage format only accepts text, but you have binary data or you have text that needs to be embedded somewhere text of that shape would otherwise break parsing. It is the standard way to inline a small image inside CSS or HTML as a data URL, to attach a file inside a JSON API request, or to pack a binary secret into an environment variable that only accepts strings.
It is the wrong tool when you actually need security. Base64 has no key, so it provides zero confidentiality. It is also the wrong tool for large files that a proper multipart upload or binary transport could carry directly, since the size increase and the extra CPU work are wasted once the transport already accepts raw bytes.
- Encode when embedding a small image or font as a CSS data URL.
- Encode when a JSON or XML payload needs to carry binary content as a string field.
- Encode an API key or certificate before storing it in a text only environment variable.
- Decode when you have received a base64 payload and need the original file or text back.
- Never rely on base64 to keep data confidential. It is an encoding, not a cipher.
Standard base64 versus the URL safe variant
Standard base64, defined in RFC 4648, uses the alphabet A to Z, a to z, 0 to 9, plus and slash, with equals signs added as padding so the output length is always a multiple of four. Both plus and slash are meaningful characters inside a URL, which means standard base64 output can silently corrupt a query string or a filename if it is dropped in unescaped.
The URL safe variant, also defined in the same RFC, replaces plus with hyphen and slash with underscore, and typically drops the trailing padding entirely since the length can be recomputed from context. This is the form used inside JSON Web Tokens and in most modern web APIs. Turn on base64 url safe output whenever the result is going to live inside a URL path, a query parameter or a filename.
Encoding a whole file, not just a text snippet
Switch to file mode and drop any file onto the panel to convert file to base64 directly. The bytes are read by the browser's File API and converted through the same encoder used for text, so a PNG, a PDF or a font file all encode correctly regardless of what bytes they contain internally.
The output is roughly 33 percent larger than the original file, since three bytes of input always become four characters of output. A 300 kilobyte image therefore becomes about 400 kilobytes of base64 text. That overhead is the reason base64 is reserved for cases where the transport genuinely requires text, rather than used as a default for moving files around.
Decoding back to text or to a file
Paste a base64 string into decode mode and the tool reverses the process. If the decoded bytes form valid UTF-8 text, they are shown directly as readable text with a copy button. If the bytes do not form valid text, which happens whenever the original input was an image, a PDF or any other binary format, the tool tells you plainly and offers a download of the raw bytes instead of trying to force them into a text box.
Malformed input is handled the same way a non engineer would want it explained. A string with an invalid character, wrong padding or a length that is not a multiple of four produces a clear error message rather than a stack trace, so you know to check that the base64 was copied in full. If you need to decode base64 string values that arrived by email or chat, paste the whole block including any trailing equals signs.
How this base64 encoder decoder works under the hood
Text encoding runs through TextEncoder to produce a UTF-8 byte array, which is then packed three bytes at a time into base64 characters using the standard alphabet, matching the algorithm in RFC 4648. Decoding reverses those exact steps, and TextDecoder is used to turn the resulting bytes back into a JavaScript string only when they are valid UTF-8.
File encoding uses the browser's own data URL reader rather than a hand written byte loop, since that path is implemented natively and handles files of any size without blocking the page. Everything happens locally. No file or string you enter is ever sent anywhere, which matters most for the API keys and tokens people frequently need to base64 encode or decode.
| Property | Standard base64 | URL safe base64 |
|---|---|---|
| Character 62 | + | - |
| Character 63 | / | _ |
| Padding | Equals signs kept | Usually omitted |
| Safe inside a URL | No | Yes |
| Common use | Email, data URLs | JWTs, filenames |
How to use this base64 encoder decoder
- 1
Choose encode or decode
Pick whether you are turning input into base64 or turning a base64 string back into its original form.
- 2
Choose text or file input
Paste text directly, or switch to file mode and drop a file onto the panel to encode its raw bytes.
- 3
Toggle URL safe if needed
Turn on the URL safe variant when the output will be placed inside a URL, a filename or a JWT segment.
- 4
Copy or download the result
Copy the text output directly, or download it when the decoded result turns out to be binary data.
Related tools worth bookmarking
Sources and further reading
- RFC 4648: The Base16, Base32, and Base64 Data EncodingsThe specification that defines both the standard and URL safe base64 alphabets used here.rfc-editor.org
- MDN: TextEncoderThe browser API this tool uses to convert text to UTF-8 bytes before base64 encoding it.developer.mozilla.org
- WHATWG Encoding StandardThe living standard that governs how browsers convert between text and byte encodings.encoding.spec.whatwg.org
Frequently asked questions
Common questions about the base64 encoder decoder.
No. Base64 is a reversible text representation of bytes with no key and no secret involved. Anyone can decode a base64 string instantly using a single standard library call. If you need confidentiality, encrypt the data first with a real cipher and only base64 encode the resulting ciphertext for transport.
The most common cause is the URL safe variant, which swaps plus and slash for hyphen and underscore and usually drops padding. Toggle that setting to match what the other tool produced. A second common cause is character encoding, since this tool always encodes text as UTF-8 bytes before converting to base64.
Base64 text must use only the standard or URL safe alphabet and its length rules must be respected. A truncated copy and paste, stray whitespace mixed into the middle of the string, or mixing standard and URL safe characters together will all produce a decoding error rather than garbage output.
Yes. The browser's built in file reader handles files well beyond typical document sizes without freezing the page, since the conversion runs natively rather than through a manual byte loop. Very large files simply take a little longer and the resulting base64 text will be about a third bigger than the original.
Only when the original input was text. If the base64 came from an image, an archive or any other binary file, the decoded bytes will not form valid UTF-8, and this tool detects that automatically and offers a file download instead of displaying broken characters.
No. Every conversion happens inside your browser using the TextEncoder, TextDecoder and File APIs. Nothing you type or upload is transmitted anywhere, which is important since people frequently paste API keys, tokens and other sensitive values into a base64 tool.