Runs in this tab. A token, a key, a config — whatever you paste stays local.
Loading the tool…
Free Online Base64 Encoder and Decoder
How it works
RFC 4648, and the two alphabets
RFC 4648 defines two alphabets over the same algorithm. §4 is standard Base64, ending in + and /. §5 is base64url, which swaps those for - and _ so the result is safe in a URL path or query string and in a JWT segment. Decoding the wrong alphabet does not always fail loudly — it can produce different bytes, which is how a corrupted signature ends up looking like a mystery.
- Standard (§4)
- A-Z a-z 0-9 + / — the default, correct for MIME, data URIs and most APIs.
- URL-safe (§5)
- A-Z a-z 0-9 - _ — required inside JWTs and anywhere the value goes into a URL.
- Padding
- = pads the output to a multiple of four characters. base64url usually drops it; JWT segments are always unpadded.
- Size
- Output is 4 characters per 3 input bytes — about 33% larger than the original, before any padding.
- UTF-8
- Text is encoded as UTF-8 bytes first. The browser's own btoa() throws on anything outside Latin-1, which is why naive implementations break on é or an emoji.
How to use it
How to encode and decode Base64 online
- 01
Paste text or Base64
Encoding and decoding are the same box; the direction is a toggle.
- 02
Choose standard or URL-safe
Use URL-safe for anything that will sit in a URL or a JWT segment.
- 03
Copy the result
Padding is added or omitted to match the alphabet you picked.
Where it earns its keep
Where Base64 shows up
- Reading the value behind a data: URI in a stylesheet or an email.
- Decoding a Basic auth header to check which user an integration is sending.
- Building the Authorization value for a quick API test by hand.
- Inspecting a base64url segment copied out of a token or a signed URL.
Questions
Base64 Encoder & Decoder, answered
Is Base64 a form of encryption?
No. It is a reversible encoding with no key and no secret — anything Base64-encoded is readable by anyone who bothers to decode it. Use it to make bytes transportable, never to hide them.
Does what I paste get uploaded?
No. Encoding and decoding happen in this browser tab, which matters when the string is an auth header or a private key you would not paste into a server-side tool.
Why does my decode produce garbage?
Usually an alphabet mismatch: a base64url string decoded as standard Base64, or the reverse. Missing padding and stray line breaks copied out of an email header do it too.
Can I Base64-encode a file here?
This tool handles text. For a file's fingerprint use the checksum tool instead — encoding a large binary to Base64 in a text box is slow and rarely what you actually needed.