Base64 turns binary data into plain ASCII text so it can travel through systems built for text — email, JSON, URLs, HTML — without corruption. This tool encodes and decodes in both directions entirely in your browser, with a URL-safe variant for addresses and tokens.
How Base64 Works
The encoding takes the input three bytes at a time (24 bits), splits them into four 6-bit groups, and maps each group to one character of a 64-character alphabet: A–Z, a–z, 0–9, plus + and /. Four characters out for every three bytes in is why Base64 output is always about 33% larger than the input:
When the input length is not a multiple of three, = padding completes the final group — one leftover byte produces two characters plus ==; two leftover bytes produce three characters plus =. This tool encodes your text as UTF-8 bytes first, so accented characters and emoji encode correctly (and decode back exactly), and the URL-safe option swaps + → - and / → _ and drops the padding — the base64url dialect used in JWTs and web tokens, whose characters survive URLs and filenames unescaped. The decoder is forgiving in the ways real-world data demands: it accepts the URL-safe alphabet, ignores stray whitespace and line breaks (as MIME email produces), and restores missing padding before decoding.
Worked Example
Encode the text API:
- Bytes: A = 65, P = 80, I = 73 → binary
01000001 01010000 01001001 - Regroup into 6 bits:
010000 | 010101 | 000001 | 001001→ values 16, 21, 1, 9 - Map through the alphabet (A = 0 … Z = 25): 16 → Q, 21 → V, 1 → B, 9 → J
- Result:
QVBJ
And Hi (two bytes) encodes to SGk= — the single = announcing the one missing byte of the final trio. Decoding reverses the process exactly; if the input is not valid Base64, the tool reports that rather than guessing.
Where You Will Meet It
Data URIs embed small images and fonts directly in HTML/CSS (data:image/png;base64,…). HTTP Basic authentication sends credentials as Base64 of username:password in the Authorization header — which works only because HTTPS encrypts the channel, since Base64 itself hides nothing. Email (MIME) encodes attachments for text-era transport protocols. JWTs are three base64url segments joined by dots — decode the first two with this tool (URL-safe mode) and you can read any token's header and payload. APIs and config files stash binary blobs — certificates, keys, images — as Base64 inside JSON and YAML.
The One Rule: Encoding Is Not Encryption
Base64 is a format, not a lock. Anyone can decode any Base64 string instantly — this page is proof — so it provides zero confidentiality: never treat an encoded password, key, or token as protected, and never let "it's encoded" substitute for encryption (AES, TLS) or hashing where those are what the job needs. Its purpose is transport compatibility: getting arbitrary bytes safely across text-only channels, intact.
Frequently Asked Questions
Why is the encoded text longer than the original?
Because each character carries only 6 bits of information instead of 8. Representing 24 bits of data takes four 6-bit characters instead of three 8-bit bytes — a fixed 4:3 ratio, i.e. roughly 33% overhead, plus up to two padding characters.
What is the difference between Base64 and base64url?
Alphabet and padding. Standard Base64 uses + and /, which are meaningful (and mangled) inside URLs; base64url substitutes - and _ and usually omits the = padding. This tool's URL-safe toggle produces base64url on encode, and its decoder accepts both dialects.
Can I encode an image or file here?
This tool is built for text: paste text to encode, or a Base64 string to decode. Encoding whole files is better done with the Image to Base64 tool on this site, which reads the file's bytes directly and returns a ready-to-use data URI.