Base64 Encoder & Decoder
Encode and decode Base64 strings entirely in your browser. Safe for config strings, API tokens, and data URIs. No data sent to any server.
Base64 Encoder & Decoder
Runs entirely in your browser — no server calls, no tracking.
Enter text and click Convert.
🔒 Your data never leaves this tab. This tool has no backend.
About the Base64 Encoder & Decoder
Base64 encoding converts arbitrary binary data — or any string — into a subset of printable ASCII characters. It is used in HTTP Basic Authentication headers, data URIs for inline images, JWT payloads, and environment variable values when the raw value contains characters that would break shell parsing or YAML formatting.
Common uses
API credentials: many services encode client_id:client_secret in Base64 and send it as an Authorization: Basic ... header. Data URIs: images and fonts can be embedded directly in CSS or HTML as data:image/png;base64,.... Config values: TLS certificates, SSH keys, and JSON blobs are often Base64-encoded before storage in environment variables or Kubernetes secrets.
Base64 is not encryption
Base64 is an encoding, not encryption. Anyone who receives a Base64 string can decode it instantly — including with this tool. Never use Base64 to "protect" sensitive data. Use it only as a transport encoding for data that is already secured or that does not need to be secured.
This tool handles Unicode correctly by using encodeURIComponent + btoa for encoding and the reverse for decoding, preventing the common "string contains characters outside Latin1" error that plain btoa throws with multi-byte characters.
Base64 encoding, decoding, and URL-safe variants
Base64 represents binary data using 64 printable ASCII characters, so it can travel through systems that only handle text — email bodies, JSON payloads, HTML attributes, HTTP headers. It costs about 33% extra size, since every three bytes become four characters.
The single most important point: Base64 is encoding, not encryption. Anyone can decode it instantly with no key. It hides nothing. Never use it to protect a password, token or any other secret.
Standard and URL-safe alphabets
Standard Base64 uses + and /, both of which have meaning in a URL and get mangled when passed as a query parameter. The URL-safe variant substitutes - and _, and usually drops the trailing = padding. If a value decodes correctly in one place and fails in another, mismatched alphabets are the first thing to check — this is why JWT segments use the URL-safe form.
Data URIs, files and PDFs
Encoding a file as Base64 lets you embed it directly in HTML or CSS as a data URI, avoiding a network request — worthwhile for tiny icons, wasteful for anything larger given the 33% overhead. Going the other way, decoding Base64 to a file or a PDF means turning the text back into bytes and saving with the right extension; the encoding itself carries no filename or type.
Why decoding fails
Usually one of: missing or wrong = padding, whitespace and line breaks inserted by an email client, a URL-safe string fed to a standard decoder, or the string being double-encoded. Strip whitespace first, then check the alphabet.
Frequently asked questions
No. Base64 is an encoding, not encryption — anyone can decode it instantly without a key. It exists to let binary data pass through text-only channels. Never use it to protect passwords, tokens or any other secret; use real encryption or transport security for that.
Standard Base64 uses + and / , which have special meaning in URLs and get corrupted in query strings. The URL-safe variant replaces them with - and _ and usually omits the = padding. If a string decodes in one system but not another, a mismatched alphabet is the most likely cause.
Decode the string back to bytes and save it with the correct file extension. Base64 carries no filename or content type, so you must know what the data was — a PDF starts with %PDF, which is a quick way to confirm. Paste the string above and download the decoded result.
Common causes are missing or incorrect = padding, whitespace and line breaks inserted by an email client, feeding a URL-safe string to a standard decoder, or the value being encoded twice. Strip whitespace first, then check which alphabet was used.
About 33% larger, because every three bytes of input become four output characters, plus padding. That overhead is why embedding large files as data URIs is usually a false economy — it is worthwhile for very small assets like icons, not for photographs.
+ and / as the 62nd and 63rd characters. URL-safe Base64 (used in JWTs and many APIs) replaces these with - and _ so the string can be embedded in a URL without percent-encoding. This tool uses standard Base64; swap +// if you need URL-safe.Need custom integrations or API tooling built?
ruxox builds production web apps and API integrations for growing businesses. Free estimate in 48 hours.