Base64 decode and encode

How to use it

1. Choose encode or decode. On the Text tab pick Encode to turn text into Base64, or Decode to read a Base64 string. For images and documents use the File tab.
2. Paste or type. The result updates as you type. When decoding, spaces and line breaks are ignored, and both standard and URL-safe alphabets are accepted, with or without padding.
3. Copy or download. Copy the result with one click. On the File tab you can copy the data URL, download it as a text file, or turn pasted Base64 back into the original file.

How Base64 works

Computers store data as bytes of 8 bits, but many channels, such as email, URLs, JSON and HTML attributes, only carry plain text safely. Base64 solves this by taking the bytes 3 at a time (24 bits) and splitting them into 4 groups of 6 bits. Each 6-bit group is a number from 0 to 63 and picks one character from a fixed alphabet: A–Z, a–z, 0–9, + and /.

When the data is not a multiple of 3 bytes, the last group is completed with zero bits and the missing characters are replaced by =. That is why “Man” encodes as TWFu, “Ma” as TWE= and “M” as TQ==. The drawing under the tool shows this bit by bit for the first three bytes of your input.

Every 3 bytes become 4 characters, so Base64 is about a third larger than the original: 30,000 bytes become 40,000 characters, 33.3% more. Text is first converted to bytes with UTF-8, which is why a single euro sign takes 3 bytes and 4 Base64 characters.

Where Base64 is used

• Email attachments: MIME encodes files in Base64 and breaks the lines at 76 characters. Turn on “Lines of 76 characters” to get the same layout.
• Data URLs in HTML and CSS: a small icon can be embedded as data:image/png;base64,… so the page needs one request less. Use the File tab to create one.
• Web tokens: JSON Web Tokens are three base64url parts separated by dots. The header {"alg":"HS256","typ":"JWT"} becomes eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9. Decoding a token shows its content, but checking the signature needs the key.
• HTTP Basic authentication: the header “Authorization: Basic dXNlcjpwYXNz” is just user:pass in Base64, which is why it must only travel over HTTPS.
• APIs and configuration files: binary data such as certificates, keys and images is often placed in JSON or YAML as Base64.

Base64 is not encryption

Base64 is an encoding, not a cipher: there is no key, and anyone can decode it in a second, with this tool or with one line of code. It hides nothing. A password, an API key or personal data stored in Base64 is as exposed as plain text.

To protect data use real encryption (for example AES) and send it over HTTPS; to store passwords use a slow hashing function designed for that purpose. Base64 only makes data travel safely through systems that expect text. For random values, such as a lottery draw or a test sample, see the random number generator.

This tool decodes in your browser, so pasting a token here does not send it anywhere. Even so, treat production tokens and keys as secrets.

Variants: URL-safe, padding and line breaks

The characters + and / have a special meaning in web addresses and file names. The base64url variant replaces them with - and _: the same bytes give PDw/Pz8+Pg== in standard Base64 and PDw_Pz8-Pg== in base64url. The = padding is often dropped as well, because the length of the string already tells where the data ends.

The decoder accepts both alphabets and works with or without padding. It reports a precise error when a character is outside the alphabet (with its position), when the length cannot be valid, or when = appears in the middle of the string. Spaces and line breaks are skipped, as MIME requires.

Worked examples

Sources

• RFC 4648, “The Base16, Base32, and Base64 Data Encodings” (IETF, 2006): section 4 (Base64 alphabet), section 5 (base64url), section 3.2 (padding), section 3.3 (characters outside the alphabet) and section 10 (test vectors). Checked 14/10/2026.
• RFC 2045, “Multipurpose Internet Mail Extensions (MIME) Part One” (IETF, 1996), section 6.8: Base64 content transfer encoding with lines of at most 76 characters. Checked 14/10/2026.
• RFC 7519, “JSON Web Token (JWT)” (IETF, 2015): use of base64url without padding. Checked 14/10/2026.

The examples on this page are computed with the same code as the tool, so the strings in the text always match what it produces.

Frequently asked questions