Base64 Encoder / Decoder
Encode text to Base64 or decode Base64 to text.
Tool code processes selected files and entered content in your browser and does not submit them to a TOOLGRID processing endpoint. TOOLGRID measures tool usage, not the content you enter.
Loading tool…
Browser-basedWhat this tool does
Convert between plain text and Base64 directly in the browser.
Standard Base64 uses the RFC 4648 +, /, and = alphabet. Base64url uses - and _, with optional padding, for JWT and URL contexts. Unicode mode supports \uXXXX, surrogate pairs, and \u{codePoint}; binary and hex modes operate on complete UTF-8 byte groups.
Each decoder fails closed. It rejects malformed escapes, invalid scalar values, incomplete binary or hex bytes, and byte sequences that are not valid UTF-8 instead of returning replacement characters or a partial result.
What you can do with this tool
JWTs are three Base64url-encoded segments joined by dots. Copy one segment, switch the mode toggle to URL-safe, and read the decoded JSON. For full JWT inspection (header + payload + signature verify), use the dedicated JWT Decoder.
Basic Auth sends a header like Authorization: Basic dXNlcjpwYXNz. The Base64 portion encodes username:password. Decode it (Standard mode) to verify what credentials your client actually sent — a fast way to find a missing trailing newline or wrong field ordering.
Some APIs require Basic Auth or a Base64-encoded shared secret in a header. Type your username:password (or your raw secret) into the input and copy the encoded output directly into your curl command, Postman header, or environment variable.
What to check before relying on the result
- Performance and maximum practical input size depend on browser memory, device speed, and the structure of the input.
- Review the generated result before replacing or publishing an original file.
How to use
- 1
Choose Standard Base64, Base64url, Unicode escapes, UTF-8 binary, or UTF-8 hex.
- 2
Paste readable text to produce the encoded representation, or paste encoded text to inspect the strict decoded output.
- 3
Confirm the byte count and status, resolve any invalid escape or byte sequence, then copy the required side.
Use Cases
JWTs are three Base64url-encoded segments joined by dots. Copy one segment, switch the mode toggle to URL-safe, and read the decoded JSON. For full JWT inspection (header + payload + signature verify), use the dedicated JWT Decoder.
Basic Auth sends a header like Authorization: Basic dXNlcjpwYXNz. The Base64 portion encodes username:password. Decode it (Standard mode) to verify what credentials your client actually sent — a fast way to find a missing trailing newline or wrong field ordering.
Some APIs require Basic Auth or a Base64-encoded shared secret in a header. Type your username:password (or your raw secret) into the input and copy the encoded output directly into your curl command, Postman header, or environment variable.
Paste an encoded segment to recover it only when the decoded bytes are valid UTF-8 text. Image, PDF, executable, and other binary payloads fail with an explicit UTF-8 error instead of being rendered as misleading replacement characters; use a binary-aware decoder for those files.
When porting tokens between systems that use different alphabets (Standard vs URL-safe), encode in one mode, switch the toggle, and the same input is re-emitted in the other variant. Faster than hand-replacing + with - and / with _.
Convert ECMAScript-style escapes, including surrogate pairs and code-point syntax, back to readable text while rejecting malformed or out-of-range values.
Render UTF-8 text as complete 8-bit binary groups or hexadecimal byte pairs, then decode the exact bytes to confirm a protocol sample or fixture.
Spotted a long blob in a log file? Paste it in — the "likely Base64" indicator tells you whether it parses as valid Base64 (alphabet + length OK). If yes, the decoded view reveals what's inside; if no, the indicator says so explicitly so you don't chase a false lead.
Tips & Tricks
Use standard Base64 for MIME, Basic Auth, and most payloads. Use Base64url for JWTs and URL-safe tokens where +, /, and padding may break transport.
Every 3 bytes become 4 Base64 characters. So a 1KB string becomes ~1.33KB encoded. For inline data URIs in CSS or HTML, only do this for very small assets (icons under 4KB) — larger assets save bandwidth as separate requests.
When you paste Base64 copied from terminals, emails, or PEM blocks (which fold at 64-76 chars per line), the tool ignores embedded whitespace. You don't need to clean up the input — it just works.
Base64 makes bytes printable; it does not hide or protect secrets. Anyone can decode it without a key.
If you see a string with no padding and - / _ characters instead of + /, it's almost certainly Base64url. Common sources: JWT header/payload segments, OAuth state parameters, PKCE code challenges, and many JSON Web Key (JWK) fields.
FAQ
Does this tool work entirely in my browser?
Encoding and decoding use built-in browser APIs (btoa/atob plus a small UTF-8 wrapper). Tool code does not submit entered content, including JWTs, API keys, or Basic Auth credentials, to a TOOLGRID processing endpoint. Review browser extensions and device security before handling sensitive material.
What's the difference between Standard Base64 and URL-safe Base64?
Standard Base64 (RFC 4648 §4) uses A-Z, a-z, 0-9, +, /, and = for padding. URL-safe Base64url (RFC 4648 §5) substitutes - for + and _ for / so the result is safe inside URLs without further encoding, and typically omits the = padding. JWTs, OAuth tokens, and many web standards use the URL-safe variant.
What do the Unicode, binary, and hex modes represent?
Unicode mode uses ECMAScript escape syntax for Unicode code points. Binary and hex modes show the UTF-8 bytes of the text as 8-bit groups or two-digit byte pairs. They are byte representations, not numeric base conversion for arbitrary integers.
Can this tool encode files or images?
No. This tool is text-only. To convert an image or binary file to a Base64 data URI, paste a small script into your browser's DevTools console — for example: `const b = await file.arrayBuffer(); const s = btoa(String.fromCharCode(...new Uint8Array(b))); console.log('data:image/png;base64,' + s);` — or use a command-line tool like `base64 < file.png`. The text input here accepts UTF-8 text up to several MB but will not parse binary file content.
Why is binary Base64 rejected instead of shown as text?
This workspace is deliberately text-only and decodes with strict UTF-8 validation. If the Base64 represents an image, PDF, executable, or another binary file, the tool reports that the bytes are not valid UTF-8 and clears the text result. Use a binary-aware decoder to recover the original file rather than treating arbitrary bytes as readable text.
Why is my JWT failing to decode?
Two common reasons: (1) you pasted only part of the JWT — make sure you're decoding ONE segment at a time (split the token on the dots), not the whole thing. (2) JWTs use URL-safe Base64 — switch the mode toggle to URL-safe and try again. For full JWT inspection with signature verification, use our dedicated JWT Decoder.
Is Base64 a form of encryption or compression?
Neither. Base64 is an encoding — a deterministic, reversible mapping that lets binary data travel safely through text-only channels (JSON, XML, HTTP headers, email). It does not protect content from being read (encoding ≠ encryption) and it actually makes data larger, not smaller (encoding ≠ compression).
Why is the Base64 output longer than the input?
Base64 uses 6 bits per character to represent 8-bit binary, so every 3 input bytes produce 4 output characters — about a 33% increase. There's no way to avoid this overhead with Base64; if size matters and the channel allows binary, send the raw bytes instead.
What's a Base64 data URI?
A data URI embeds content directly in a URL using the syntax data:[mime-type];base64,<encoded>. Example: data:image/png;base64,iVBORw0KGgo... You can use this in CSS (background-image), HTML (img src), or anywhere a URL is expected. Best for tiny assets — larger ones bloat HTML/CSS files and hurt cache efficiency.
Can I decode a Base64 string that was copied with extra newlines?
Yes. The tool ignores whitespace inside the input — line breaks, spaces, and tabs are stripped before decoding. PEM-style content (which wraps at 64-76 chars per line) and shell-copied output paste cleanly.
Why does the "likely Base64" indicator say No on valid text?
The detector checks both the character set (only Base64 alphabet allowed, plus padding) and the length (a multiple of 4 for standard Base64). Plain English text usually contains characters outside the Base64 alphabet (spaces, punctuation, etc.) and so is correctly flagged as not-Base64. This is a feature — it prevents the decoder from trying to interpret arbitrary text as Base64 and producing nonsense.
Useful next steps
Open a nearby browser tool when you need to validate, convert, or reuse the result.