How to use the Base64 encoder and decoder
- Paste your text or your Base64 into the input box. Multi-line text is fine, and so are Base64 values pasted with the line breaks that email clients insert.
- Choose a direction: Encode to Base64 turns readable UTF-8 text into Base64, and Decode from Base64 turns Base64 back into text.
- Read the result in the lower box. Copy puts it on your clipboard; Use result as input feeds it back into the converter so you can check a round trip.
- If decoding fails, read the message under the buttons. It separates an illegal character, an impossible length and a binary payload, because each of those has a different fix.
What Base64 is, and what it is not
Base64 is a binary-to-text encoding described in RFC 4648. It takes raw bytes and rewrites every three bytes as four characters drawn from a 64-symbol alphabet: A–Z, a–z, 0–9, plus + and /. When the input does not divide evenly, one or two = signs pad the end. The result contains only ASCII, so it can travel through systems that were never designed to carry raw bytes.
That is the whole job. Base64 does not compress, and it does not encrypt: anyone holding the string can decode it without a key. It is used to embed images in CSS or HTML as data URLs, to carry JSON payloads through APIs, to store credentials in HTTP Basic authentication headers, to pack email attachments in MIME, and to hold the header and payload of a JSON Web Token. When you decode one of those values, what comes out depends on the original bytes: UTF-8 text comes back as text, while a PNG stays binary.
Base64 vs URL encoding: which one do you need?
The two encodings solve different problems, and mixing them up is the most common reason a converter seems to produce nonsense. Base64 makes binary data safe for text channels. URL encoding makes text safe for the narrow grammar of a URL. A percent-encoded string is not Base64, and a Base64 decoder will reject it.
| Aspect | Base64 | URL encoding (percent-encoding) |
|---|---|---|
| What it protects | Raw bytes travelling through text-only systems | Text inside a URL component |
| Alphabet | A–Z, a–z, 0–9, +, / and = padding | Safe characters stay; everything else becomes %XX |
| Size change | About 33% larger | Only escaped characters grow; plain ASCII stays one byte |
| Typical use | data: URLs, JSON blobs, JWT, email attachments | Query values, path segments, redirect parameters |
| Readable output | Usually not — Base64 looks like random letters | Yes, with spaces and punctuation visible |
If you are building a link and the value contains spaces, ampersands or non-ASCII text, use URL Encode. If you are moving an image or any binary payload through a text field, use Base64. The URL decoder is the matching tool for strings that already contain %20-style escapes.
Doing it from the command line
Every platform has a built-in way to encode Base64, and it is worth knowing when a browser tab is not the right tool. The commands below assume UTF-8, which is the default on current macOS, Linux and PowerShell versions.
| Platform | Encode | Decode |
|---|---|---|
| Windows PowerShell | [Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes('Hello')) | [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($b64)) |
| Windows certutil | certutil -encode input.txt output.b64 | certutil -decode output.b64 output.txt |
| macOS / Linux | printf 'Hello' | base64 | tr -d '\n' | printf 'SGVsbG8=' | base64 --decode |
| Node.js | Buffer.from('Hello', 'utf8').toString('base64') | Buffer.from(b64, 'base64').toString('utf8') |
| Python 3 | base64.b64encode('Hello'.encode()).decode() | base64.b64decode(b64).decode() |
Two platform details are worth remembering. certutil wraps its output in -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- lines; strip both lines before the value is used anywhere else. And macOS ships BSD base64, which decodes with base64 -D on older releases and base64 --decode on newer ones, while GNU base64 uses -d. Wrapped or unwrapped, the browser converter above removes whitespace before decoding, so MIME line breaks are not a problem here.
Why the conversion runs locally
Everything on this page is JavaScript that runs in the tab. There is no API call behind the Encode or Decode buttons and no request that carries your text anywhere. That matters when the string in your clipboard is not a toy: API responses, customer records and access tokens are exactly the kind of values people paste into Base64 tools. A converter that posts them to a server has to be trusted with them; this one never sees them.
The trade-off is that the page has to do the work itself, so extremely large values of tens of megabytes will be slower than a native command-line tool. For everything up to a few megabytes it is indistinguishable in practice, and you can confirm the absence of network activity yourself in the browser’s developer tools.
Frequently asked questions
Is Base64 the same as encryption?
No. Base64 is an encoding: it changes how bytes are written, not who can read them. Anyone with the encoded string can decode it without a key, so it must never be used to protect passwords, tokens or personal data. Use it only to move data through text-only channels.
Does this tool upload my text to a server?
No. Encoding and decoding run in JavaScript inside your browser. After the page loads, the converter makes no network requests, so your input never leaves the tab. You can disconnect from the internet and the tool keeps working.
Why is the Base64 result longer than my text?
Base64 represents every three bytes as four ASCII characters, which adds about 33%. Non-Latin text grows more because each Chinese character or emoji occupies three or four UTF-8 bytes before encoding. Padding characters can add one or two more characters on top of that.
Can I decode Base64 that contains line breaks?
Yes. Spaces, tabs and line breaks are removed before decoding, so values wrapped at 76 characters by email software work exactly as they are. Padding is also recalculated when a copy is missing it, which happens often when a string is trimmed by a log viewer.
What is URL-safe Base64?
Standard Base64 uses + and /, which can break inside a URL. URL-safe Base64 (RFC 4648 section 5) swaps them for - and _ and often drops the = padding. This tool accepts both forms, so a JWT segment or a Base64 value taken from a query string decodes without editing.