Base64 Encoder and Decoder

What Base64 is for

Base64 is a binary-to-text encoding. It takes arbitrary bytes and represents them using only 64 characters that survive any text channel: A–Z, a–z, 0–9, plus + and /, with = used as padding. The mechanism is simple — three input bytes (24 bits) are re-sliced into four 6-bit groups, and each group becomes one character. Because 6 bits have 64 possible values, the alphabet fits exactly.

It exists because a great many protocols were designed to carry text, not bytes. Email headers, JSON string fields, HTTP header values, XML documents, URLs, environment variables and copy-paste buffers all mangle or reject raw binary. Wrapping the bytes in Base64 makes them inert: a certificate, an image thumbnail, an encrypted blob or a signature becomes a string that any of those channels will carry unchanged.

Base64 is not security

This bears repeating because it is a persistent source of real vulnerabilities. There is no key. Anyone who receives a Base64 string can decode it in one step — this page does it instantly and offline. Base64 obscures nothing. HTTP Basic authentication is the classic illustration: the header Authorization: Basic dXNlcjpwYXNz is a username and password in plain sight, which is exactly why Basic auth is only acceptable over TLS.

Standard Base64 vs Base64url

The two extra characters in standard Base64, + and /, are both meaningful in URLs — / is a path separator and + is decoded as a space in application/x-www-form-urlencoded data. So a second alphabet was standardised for that context: Base64url substitutes - for + and _ for /, and typically omits the trailing = padding, since = also needs escaping in a query string.

This matters constantly when working with tokens. Every segment of a JSON Web Token is Base64url, which is why a strict standard decoder can reject a perfectly valid one. Switch the selector above to URL-safe, or let the JWT decoder handle the whole token structure for you.

Where it shows up in API work

• Basic authentication. Authorization: Basic followed by base64(user:password). See the HTTP headers guide for the rest of the authentication headers.
• JWTs. Three Base64url segments joined with dots.
• Data URIs. data:image/png;base64,… embeds a small image directly in HTML or CSS instead of making a separate request.
• Binary fields in JSON. JSON has no byte type, so file contents, hashes and signatures travel as Base64 strings inside a JSON document.
• Webhook signatures. HMAC digests are commonly delivered Base64-encoded in a header.
• Kubernetes secrets and CI variables. Values in a Secret manifest are Base64, which is encoding for transport — not, despite the name, protection.

Common pitfalls

Non-ASCII text and the "InvalidCharacterError"

The browser's built-in btoa only accepts characters in the range 0–255, so passing it café or an emoji throws. Correct encoding means converting the string to UTF-8 bytes first, then Base64-encoding those bytes. This tool does that, so café encodes to Y2Fmw6k= — note the two bytes for é — and round-trips exactly.

Missing or wrong padding

Standard Base64 length is always a multiple of four, padded with =. Values that have been through a URL-safe pipeline usually have the padding stripped, and a strict decoder will refuse them. This decoder restores padding automatically before decoding.

Plus signs turning into spaces

If a standard Base64 value is placed in a query string without being percent-encoded, the receiving side decodes every + as a space and the value silently corrupts. Either use Base64url, or percent-encode the value with the URL encoder before putting it in a URL.

Line wrapping

MIME Base64 wraps at 76 characters. PEM certificates wrap at 64. Those newlines are part of those formats, not the value, and must be stripped before decoding — this tool removes whitespace for you.

Size growth

Output is roughly 4/3 the size of the input. Encoding a 3 MB file to embed in a JSON body produces about 4 MB of text, which is enough to hit request size limits and inflate memory use on both ends. Prefer multipart uploads or a direct binary body when the payload is large.

Frequently asked questions

Related tools and reference