Base64 Encoder and Decoder
Encode text to Base64 or decode Base64 back to plain text, with full Unicode and emoji support. Runs locally in your browser — nothing is uploaded.
Runs entirely in your browser — nothing is uploaded
What Base64 is for
Base64 rewrites arbitrary binary data using only 64 characters that survive text-only systems: the letters, the digits, plus + and /. It exists because a great deal of infrastructure assumes it is carrying text, and will quietly corrupt raw bytes.
You meet it in email attachments, in images embedded in CSS as data: URLs, in binary fields inside JSON payloads, and in the segments of a JSON Web Token. In every case the job is the same: move bytes safely through a channel that only guarantees text.
Base64 is not encryption
This is the most consequential misunderstanding about it, so it is worth stating plainly: Base64 provides no security whatsoever. There is no key, and anyone can reverse it in a second — including on this page.
Never use it to protect a password, an API key or personal data. If a system stores credentials Base64-encoded, they are stored in plain text with extra steps. Encoding answers the question “can this data travel here safely?”; encryption answers “can anyone else read this?”, and only the second one protects anything.
Unicode, emoji and why some tools fail
The browser functions btoa() and atob() only accept characters in the range 0-255, so they throw an error the moment you feed them an emoji, a Chinese character, or even a plain é. Simple online encoders that call them directly break in exactly the same way.
This tool converts your text to UTF-8 bytes before encoding, and decodes back through UTF-8 afterwards. That is why café, 日本語 and 🎉 all survive a full round trip unchanged.
URL-safe Base64
Standard Base64 contains + and /, both of which carry meaning inside a URL, and it ends in = padding that has to be escaped in a query string. The URL-safe variant defined in RFC 4648 substitutes - and _ and drops the padding.
JSON Web Tokens use this variant, which is a handy identification trick: if a string you are decoding contains - or _ but never + or /, it is almost certainly URL-safe Base64. The decoder here accepts both forms automatically and restores missing padding, so you do not need to know which you have.
Size, padding and the 33% overhead
Base64 encodes every 3 bytes of input as 4 output characters, making the result roughly 33 percent larger. That is why inlining a large image as a data: URL is usually a mistake — you pay the size penalty, lose separate caching for the image, and block the stylesheet or document it is embedded in.
When the input length is not a multiple of three, one or two = characters pad the final block. They carry no data, but most decoders reject a string whose length is not a multiple of four, so do not strip them unless you are deliberately producing the URL-safe form.
Everything happens in your browser
Encoding and decoding run locally on your machine. Nothing is uploaded, stored or logged — which matters here more than for most tools, since the strings people need to decode are so often tokens and internal identifiers.
Frequently asked questions
Is Base64 a form of encryption?
No, and this is the most costly misunderstanding about it. Base64 is reversible by anyone, with no key at all. Never use it to protect passwords, tokens or personal data — it only makes binary data safe to travel through text-only channels.
Why do other tools break on emoji and accented characters?
The browser btoa() function only handles characters in the Latin-1 range, so it throws an error on anything else. This tool encodes to UTF-8 first, which is why é, ñ, 日本語 and 🎉 all round-trip correctly.
Why is Base64 output bigger than the input?
It represents every 3 bytes as 4 characters, so the result is about 33 percent larger. That overhead is the price of making binary data survive systems that only accept text, such as email bodies, JSON fields and data URLs.
What are the equals signs at the end?
Padding. Base64 works in blocks of three input bytes, so when the input length is not a multiple of three, one or two = characters are appended to fill the final block. Stripping them will break most decoders.
What is URL-safe Base64?
A variant that replaces + with - and / with _ so the result can sit in a URL or a filename without being escaped. JSON Web Tokens use it. If a string you are decoding contains - or _, it is almost certainly this variant.