Base64 encoder / decoder
Convert text to and from Base64. UTF-8 safe · in your browser
How to use the Base64 encoder
- Type or paste into the input box — plain text if you're encoding, Base64 if you're decoding.
- Click Encode → to get standard Base64 (the
+//alphabet with=padding). Your text is converted to UTF-8 bytes first, so emoji and accented characters encode correctly. - Click Decode ← for the other direction. Whitespace and line breaks are stripped before decoding, so Base64 wrapped across lines — from an email source, a PEM file or a YAML manifest — pastes straight in.
- Anything that isn't decodable shows “That isn't valid Base64.” instead of output.
- Hit Copy result to grab the converted text.
Common uses
- Decode the values in a Kubernetes Secret manifest, a CI pipeline variable or a config file — base64-encoded settings are everywhere in DevOps.
- Build an HTTP Basic-auth header by encoding
user:password, or decode one from a config to see which account a script is using. - Encode a small text payload — an SVG, a JSON blob — for a
data:URL or an API field that only accepts plain text. - Inspect a suspicious chunk of Base64 from an email, webhook payload or script to see what it actually says.
Tips & limitations
- Base64 is encoding, not encryption — anyone can reverse it instantly. Never use it to “protect” a secret; for that, use the text encryptor.
- JWTs and many URL tokens use base64url, a variant with
-and_instead of+and/— this tool rejects those characters. Paste whole JWTs into the JWT decoder instead. - It's text-only: decoding the Base64 of an image or ZIP won't reconstruct the file — bytes that aren't valid UTF-8 text come out as
�replacement characters. (The image-to-Base64 tool covers the file direction.) - Encoded output is about 33% bigger than the input — every 3 bytes become 4 characters. Base64 exists to survive text-only channels, not to save space.
- Missing
=padding at the end is tolerated when decoding, so slightly truncated-looking Base64 copied from logs usually still decodes.
How it's built & why it's safe
Encoding pipes your text through TextEncoder to get UTF-8 bytes, then the browser's native btoa produces the Base64; decoding reverses the trip with atob and TextDecoder. The UTF-8 step matters — raw btoa can't handle characters outside Latin-1, which is why naïve converters choke on emoji. Everything runs locally in the page: the tokens, credentials and payloads you paste are never uploaded or stored anywhere.
Related tools: Image to Base64 · URL Encoder · JWT Decoder · Text Encryptor
Further reading: JWTs explained: what's inside a token and how to debug it
Frequently asked questions
Is Base64 encryption?
No — it's a reversible encoding with no key and no secrecy; anyone who sees Base64 can decode it in a second. Use it to move data through text-only channels, and use real encryption when you need confidentiality.
Why won't my JWT decode?
JWT segments use base64url, which swaps + and / for - and _, and this tool accepts only the standard alphabet. A dedicated JWT decoder splits the token's three parts and handles the URL-safe alphabet for you.
Can I decode a file, like an image?
Not usefully — the decoder interprets the result as UTF-8 text, so binary data comes out as unreadable replacement characters. Encoding files into Base64 is what the image to Base64 tool is for; reconstructing files from Base64 isn't offered here.
Why is the encoded version longer than my text?
Base64 spends 4 output characters for every 3 input bytes, so output grows by roughly a third, plus up to two = padding characters. That's the price of data that survives any text-safe channel.
Does line-wrapped Base64 from an email work?
Yes — all whitespace, including line breaks, is stripped before decoding, so 76-column MIME wrapping pastes fine. Missing padding at the end is tolerated too, which helps with Base64 copied out of logs.
Is what I paste kept private?
Yes — encoding and decoding run on the browser's built-in functions right in the page, and your text is never sent to a server or saved. That matters, because Base64 blobs often contain credentials.