Developer
Base64 Encoder / Decoder
Encode and decode Base64 text and files instantly, entirely client-side, with no upload and no size limit imposed by a server.
Base64 encoder
URL-safe Base64 swaps "+"/"/" for "-"/"_" and drops the "=" padding, so the result is safe to use directly inside a URL or a query string with no extra escaping. Turn it on for a JWT or a value going into a link; leave it off for MIME, data URIs, or anything you are decoding as standard Base64.
Nothing entered yet — encoded output will appear above as you type or paste.
File to Base64
Encode a file — including an image, for a live preview — up to 5.0 MB. The file is read on THIS device with the browser's own file reader; it is never uploaded anywhere.
Type or paste text above to see it turned into Base64 instantly, or switch to Decode to turn Base64 back into text — the Swap button flips direction and carries today's result across, so checking a round trip is one click rather than a copy-paste. Nothing you type, paste or upload here is sent anywhere: every conversion runs as JavaScript inside this browser tab, which matters more for this tool than most, since a session token or an API key is exactly the kind of thing people paste in to decode.
Base64 encoder: turn text into Base64 online
Type or paste any text into the left box in Encode mode and the Base64 output appears on the right as you go, with a Copy button once there's something to copy. Encoding never fails, no matter what you type — a blank input encodes to a blank output, and a paragraph mixing five different scripts and a string of emoji encodes exactly as reliably as a single English word, because of how the conversion is done under the hood (see "Why do some Base64 tools break on Chinese, Arabic or emoji text?" below for the full explanation).
Base64 decoder: turn Base64 back into text online
Switch to Decode and paste a Base64 string into the left box to see the original text on the right. Unlike encoding, decoding CAN fail — not every string of characters is valid Base64 — and when it does, this tool names exactly which of four problems it found rather than showing a bare "invalid input":
- Invalid character — a character outside the Base64 alphabet was found, and the message names it and its position. If it's a "+" or "/" while URL-safe is on, or a "-" or "_" while it's off, the message says so directly, since that specific mismatch is the single most common reason a paste fails.
- Wrong length — Base64 works in groups of four output characters per three input bytes, so a valid string's length (once padding and whitespace are set aside) can only end in a remainder of 0, 2 or 3 characters after dividing by four; a remainder of 1 is never valid Base64 at all, which usually means a character was dropped or doubled somewhere in the paste.
- Bad padding — the "=" characters at the end don't match what the length calls for: too many, too few, or one showing up before the very end. See "Why does my Base64 have == at the end?" below for what padding is actually doing.
- Not valid UTF-8 text — the Base64 decoded to real bytes just fine, but
those bytes aren't a valid UTF-8 text string. This is the expected result of
pasting in an image, a font, or any other binary file's Base64 rather than a
piece of text — try File to Base64 mode instead, or paste the full
data:image/...;base64,...URI to get an image preview instead of a text decode.
Whitespace and line breaks inside a pasted Base64 blob (common in line-wrapped MIME or PEM data) are ignored automatically before any of the checks above run, so a value copied out of an email attachment or a certificate file doesn't need to be manually squeezed onto one line first.
URL-safe Base64: what it changes and when you need it
The URL-safe checkbox above the input swaps "+" and "/" for "-" and "_" and
drops the trailing "=" padding — the variant every JSON Web Token (JWT) uses
by specification, and the one you want for a Base64 value going straight into
a URL, a query parameter or a filename. Leave it off for MIME email
attachments, most data: URIs, and anything documented as plain "Base64" with
no mention of being URL-safe. Getting the toggle wrong is the single most
common decode failure this tool sees — if the error message mentions "this
looks like standard Base64" or "this looks like URL-safe Base64," that's this
exact mismatch, and flipping the toggle is usually the whole fix.
File to Base64 and image to Base64 with a live preview
The File to Base64 section below the text converter reads a file directly off
your device — using the browser's own file-reading API, never a network
upload — and shows its Base64 text plus a Copy button. Pick an image and
you'll also get a live preview rendered from the resulting data: URI, which
is the same technique used to embed a small icon directly inside CSS or HTML
without a separate image request. The limit is 5 MB per file; see "Can I
convert a file or an image to Base64, and what's the size limit?" above for
why that number specifically.
Does anything I paste here get uploaded?
No. Every figure and every conversion on this page happens synchronously in
your own browser, and there is no fetch, no upload and no analytics call
carrying the CONTENT of what you typed — a fact you can check yourself by
opening your browser's developer tools, switching to the Network tab, and
watching it stay empty while you encode or decode. That is a deliberate,
platform-wide rule for every tool on this site, not a claim specific to this
page, and it matters especially here: this is one of the few tools where
people commonly paste in something genuinely sensitive, like an authentication
token or an API key, specifically to see what it contains.
Questions
- What is Base64 used for?
- Base64 turns arbitrary binary data — bytes that might include control characters, null bytes or anything else a text-only system chokes on — into a string built from just 64 printable ASCII characters (A-Z, a-z, 0-9, plus two more). It exists because a lot of the infrastructure the internet runs on was designed to carry text safely but not arbitrary bytes: email (MIME attachments), URLs and query strings, JSON and XML documents, HTTP Basic Authentication headers, and JSON Web Tokens (JWTs) all lean on it. It is not encryption and it is not compression — Base64 makes data about 33% larger, and anyone can decode it back to the original with no key at all, which is exactly what this tool does in reverse.
- Why does my Base64 have == at the end?
- Base64 works in groups of three raw bytes, which it turns into four output characters. When your data's length isn't a multiple of three, the last group is short a byte or two, and "=" is the padding character that fills the gap so every output block still comes out to a multiple of four characters — one "=" for one leftover byte, two "==" for two leftover bytes, and none at all when the length divides evenly by three. It's not a delimiter or an error marker; it's purely there so decoders (this one included) know exactly where real data stops and filler begins. The one place you'll reliably NOT see it is URL-safe Base64, which treats the padding as optional — see "URL-safe Base64" below.
- Is it safe to decode Base64 online, including tokens or credentials?
- With this specific tool, yes, in a way that's checkable rather than just promised: encoding and decoding both run as plain JavaScript inside your own browser tab, and nothing you type, paste or upload is sent to any server — there is no network request in this widget at all, which you can confirm yourself by opening your browser's Network tab while using it. That distinction matters here more than for most tools, because a JWT, an API key or a Basic-Auth header is exactly the kind of thing people paste into a Base64 decoder, and a tool that quietly logged that string on a server would be a real credential leak. Many "Base64 decode online" tools you'll find elsewhere DO post your input to a server to do the work — always check for that before pasting in anything sensitive, on any tool, not just this one.
- What is URL-safe Base64, and when do I need it?
- Standard Base64 uses "+" and "/" as two of its 64 characters, and both have a special meaning inside a URL — "+" often means a literal space, and "/" separates path segments — so a standard Base64 string dropped straight into a URL or query parameter can silently corrupt on the way. URL-safe Base64 swaps those two characters for "-" and "_", which have no special meaning in a URL, and conventionally drops the "=" padding as well since it's rarely needed outside MIME. You need it for a JSON Web Token (every JWT is URL-safe Base64 by specification), for a value you're putting into a query string or a filename, or for anything a router or web framework might otherwise misinterpret. Turn the toggle on above for any of those; leave it off for MIME email attachments, data: URIs, or anything else labelled plain "Base64".
- Why do some Base64 tools break on Chinese, Arabic or emoji text?
- Because many of them call the browser's built-in `btoa()` and `atob()` functions directly on visitor-typed text, and both of those work one UTF-16 code unit at a time — `btoa()` throws an `InvalidCharacterError` the instant it meets a code unit above U+00FF. Plain English text and even a lone accented letter like "é" can survive, which is exactly what makes the bug easy to miss in casual testing; a whole word in Chinese, Arabic, Hebrew, Korean or Japanese, or a single emoji, cannot. This tool never hands `btoa`/`atob` your text directly: it converts text to UTF-8 bytes first (`TextEncoder`) and Base64-encodes those bytes, then reverses the same path on decode (`TextDecoder`) — so Base64 encoder online usage for CJK script, right-to-left Arabic or Hebrew, and multi-codepoint emoji sequences all round-trip back to the exact original text.
- Can I convert a file or an image to Base64, and what's the size limit?
- Yes — the File to Base64 section below reads a file straight off your device using the browser's own file reader (never uploaded anywhere) and produces its Base64 text, with a live image preview when the file is a picture. The limit is 5 MB per file: Base64 makes data about a third larger, and a resulting string past that size is what starts making the page itself sluggish to hold in memory and select as text, rather than any restriction on what Base64 itself can represent. For most icons, small photos, and embedding a logo directly in CSS or HTML as a data: URI, 5 MB is comfortably more than enough headroom.