Encode Decode ### Text Input Sample Live Preview _Hello, World!_ Encode Clear ### Base64 OutputLive Start typing to see live preview... # Base64 Encoder & Decoder - Free Online Tool Encode text to Base64 or decode a Base64 string back to UTF-8 text. Supports Unicode and emoji, runs locally in your browser, and is free to use without an account. ## What Is Base64 Encoding? A Complete Guide **Base64** is a binary-to-text encoding scheme that converts binary data into a string of 64 printable ASCII characters - uppercase A–Z, lowercase a–z, digits 0–9, plus `+` and `/`. The encoding takes every 3 bytes of raw input and maps them to exactly 4 Base64 characters, using `=` padding when the input length is not a multiple of 3. The result is a text-safe representation that can travel through any system designed to handle plain text without corrupting binary payloads. The name "Base64" comes directly from the mathematical base of the encoding: 64 possible values per character, compared to binary (base-2) or hexadecimal (base-16). Each Base64 character represents exactly 6 bits of data, so 4 characters = 24 bits = 3 bytes of original binary data. This predictable math is why Base64-encoded data is always roughly 33% larger than the original - a common trade-off developers accept for compatibility across text-only channels. Originally specified in **RFC 2045** as part of the MIME email standard, Base64 has since become a foundational building block of the web. You will encounter it in HTTP Basic Authentication headers (`Authorization: Basic dXNlcjpwYXNz`), JSON Web Token (JWT) payloads, data URIs for embedding images in HTML and CSS, API payloads, XML/JSON serialization of binary fields, and TLS certificate fingerprints. Understanding Base64 encode and decode is a core skill for any web developer or security engineer. ### How to Use This Base64 Encoder / Decoder Tool This free online Base64 tool processes everything **entirely in your browser**. Nothing is uploaded to any server - your data stays private on your device. #### Encoding Text to Base64 1. Select the **Encode** tab at the top. 2. Enable **Live Preview** to see the result as you type. 3. Type or paste text such as plain text, JSON, XML, HTML, or Unicode characters. 4. The encoded Base64 string appears in the output panel; if Live Preview is off, click Encode. 5. Click **Copy** to copy the result to your clipboard. #### Decoding Base64 to Text 1. Select the **Decode** tab. 2. Paste your Base64-encoded string into the input field. 3. The decoded plain text is shown instantly in the output panel. 4. If the Base64 string is malformed, a clear error message is displayed. 5. Click **Copy** to copy the decoded output. Use the **Sample** button to load an example in the selected mode. The resizable split view lets you adjust panel widths by dragging the divider. Use the fullscreen button to focus on the output. The page saves your last input in browser storage and can restore it for 30 days; use Clear to remove it sooner. ### Base64 Encoding Examples #### Text → Base64 **Input:** ``` Hello, World! ``` **Output:** ``` SGVsbG8sIFdvcmxkIQ== ``` **Input (JSON):** ``` {"user":"alice","role":"admin"} ``` **Output:** ``` eyJ1c2VyIjoiYWxpY2UiLCJyb2xlIjoiYWRtaW4ifQ== ``` #### Base64 → Text **Input:** ``` SGVsbG8sIFdvcmxkIQ== ``` **Output:** ``` Hello, World! ``` **Input (HTTP Basic Auth):** ``` dXNlcjpwYXNzd29yZA== ``` **Output:** ``` user:password ``` ### Where Is Base64 Used in Real-World Development? Base64 encoding is ubiquitous in modern software. Here are the most common scenarios where developers need a fast **Base64 encoder online** tool: #### HTTP Basic Authentication The HTTP Basic Auth scheme requires credentials in the format `username:password`, Base64-encoded and passed in the `Authorization` header. For example, `user:pass` encodes to `dXNlcjpwYXNz`. This is not encryption - it only enables safe transport over ASCII-only HTTP headers. Always use HTTPS alongside Basic Auth. #### JSON Web Tokens (JWT) JWT header and payload sections use Base64URL, which differs from standard Base64. For an easier way to inspect a token's readable sections, use the [JWT Decoder](https://www.toolcomb.com/jwt-decoder). Decoding a token does not verify its signature. #### Embedding Images in HTML/CSS (Data URIs) Small icons and inline images can be embedded in HTML or CSS using data URIs: `src="data:image/png;base64,iVBORw..."`. This page handles text, not direct image uploads; use [Image to Base64](https://www.toolcomb.com/image-to-base64) for an image file. #### Email Attachments (MIME) Email servers were historically built to carry 7-bit ASCII text. MIME (Multipurpose Internet Mail Extensions) uses Base64 to encode attachments - PDFs, images, and any binary file - so they survive the text-only transport without corruption. RFC 2045 defined this standard, making Base64 a prerequisite for modern email infrastructure. #### REST APIs and JSON Payloads JSON does not natively support binary data. When APIs need to transmit images, audio, or binary files within JSON, Base64 encoding converts the binary to a string field. Base64-encoded file uploads are common in chat APIs, document generation services, and OCR or vision AI APIs that accept images as base64 strings. #### Cryptographic Keys and Certificates PEM (Privacy Enhanced Mail) format - the standard for SSL/TLS certificates, SSH keys, and GPG keys - uses Base64 to encode the underlying DER binary data between `-----BEGIN CERTIFICATE-----` and `-----END CERTIFICATE-----` markers. Inspecting or converting certificates frequently requires Base64 decode operations. #### Subresource Integrity (SRI) When loading scripts or stylesheets from a CDN, browsers verify resource integrity using hashes encoded as Base64 in the `integrity` attribute: `integrity="sha256-abc123..."`. Generating or verifying SRI hashes requires Base64 encoding of the SHA-256 or SHA-384 digest. #### Configuration Files and Environment Variables Base64 can represent multiline configuration as a single text value where a workflow requires it. It does not protect secrets, and this page saves entered text locally; use your organization's approved secret-management workflow for real credentials. ### How to Troubleshoot a Base64 String If a Base64 string does not decode as expected, start by checking what the source says it represents. This page converts standard Base64 to UTF-8 text; it is not a general-purpose file decoder. A valid Base64 value can represent image bytes, an archive, or another binary format that cannot be displayed as text. An error in that situation does not necessarily mean the original file is corrupt. Next, check whether the source uses standard Base64 or Base64URL. JWT sections commonly use the URL-safe form, and their padding can be omitted. The [JWT Decoder](https://www.toolcomb.com/jwt-decoder) is a better starting point for inspecting a token's header and payload. Use only tokens you are authorized to inspect, and remember that viewing a payload is different from verifying a signature. Some values come with a prefix such as `data:image/png;base64,`. That prefix describes the content and is not part of the encoded payload. For an image file you want to encode, use [Image to Base64](https://www.toolcomb.com/image-to-base64) instead of pasting binary data into a text field. For percent-encoded URL components such as `%20`, use the [URL Decoder](https://www.toolcomb.com/url-decoder); percent encoding and Base64 are different formats. If the output should be JSON, compare it with the original before reformatting. Extra quotation marks, an accidental newline, or a copied prefix can change the input. Once decoded, the [JSON Formatter](https://www.toolcomb.com/json-formatter) can make a valid JSON document easier to read. If you need a fixed-length fingerprint for an integrity comparison rather than reversible encoding, use the [Hash Generator](https://www.toolcomb.com/hash-generator). For a quick text check, select Encode and enter `Hello, World!`. The expected output is `SGVsbG8sIFdvcmxkIQ==`. Select Decode and paste that output to recover the original text. Accented letters and emoji are converted using UTF-8, so the other system must also interpret the decoded bytes as UTF-8 to display them correctly. ### Base64 vs Encryption: Critical Security Distinction **Base64 is NOT encryption.** This is the single most important thing to understand about Base64. It is an _encoding_ scheme, not a _security_ mechanism. Anyone with a Base64 decoder (including this tool) can instantly read any Base64-encoded data. There is no key, no password, and no cryptographic protection involved. #### Base64 (Encoding) - Reversible with no key - Purpose: text-safe transport - Output grows ~33% - Not secure for secrets #### Hashing (SHA-256) - One-way, irreversible - Purpose: integrity check - Fixed-size output - Secure for checksums #### Encryption (AES-256) - Reversible with secret key - Purpose: confidentiality - Output is unreadable - Secure for sensitive data Never store passwords, API keys, or sensitive personal data in Base64-encoded form and assume it is protected. Use proper encryption (AES-256-GCM) or hashing with salting (bcrypt, Argon2) for security-sensitive data. ### Base64 Encoding Algorithm: How It Works Under the Hood Understanding the Base64 algorithm helps debug encoding errors and character set issues. Here is a step-by-step breakdown: 1. **UTF-8 conversion:** The input text is first converted to its raw byte representation using UTF-8 encoding. For ASCII characters, each character is 1 byte. For Unicode characters (accents, CJK, emojis), each character may be 2–4 bytes. 2. **Group into 3-byte chunks:** The byte stream is split into groups of 3 bytes (24 bits each). 3. **Split each 24-bit group into four 6-bit values:** Each 6-bit value (0–63) maps to a character in the Base64 alphabet: A=0, B=1, … Z=25, a=26, … z=51, 0=52, … 9=61, +=62, /=63. 4. **Add padding:** If the input is not divisible by 3, one or two `=` characters are appended to make the encoded length a multiple of 4. **Base64URL** is a variant used in JWTs and URLs that replaces `+` with `-` and `/` with `_`. Some formats, including JWT, omit `=` padding. This page outputs standard Base64 rather than automatically converting to Base64URL. **Character set matters:** Always specify UTF-8 when encoding Unicode text. Encoding as a different character set (Latin-1, Windows-1252) will produce a different Base64 string and cause decoding errors if the receiver expects UTF-8. Our tool always uses UTF-8. ### Base64 Encode/Decode Code Examples Use the following code snippets to perform Base64 encoding in popular programming languages: #### JavaScript (Browser) ``` // Encode const encoded = btoa(unescape(encodeURIComponent("Hello 🌍"))); // Decode const decoded = decodeURIComponent(escape(atob(encoded))); ``` #### Python ``` import base64 # Encode encoded = base64.b64encode("Hello".encode()).decode() # Decode decoded = base64.b64decode(encoded).decode() ``` #### Node.js ``` // Encode const encoded = Buffer.from("Hello").toString("base64"); // Decode const decoded = Buffer.from(encoded, "base64").toString("utf8"); ``` #### PHP ``` // Encode $encoded = base64_encode("Hello World"); // Decode $decoded = base64_decode($encoded); ``` ### Frequently Asked Questions About Base64 #### What is Base64 encoding used for? Base64 is used for encoding binary data (images, files, certificates) into ASCII text so it can be safely transmitted over text-based protocols like HTTP, SMTP (email), and JSON/XML APIs. Common use cases include embedding images in HTML/CSS as data URIs, encoding credentials in HTTP Basic Authentication headers, encoding JWT header and payload sections, transmitting binary files in REST API JSON bodies, and storing PEM-format cryptographic keys and certificates. #### Is Base64 encryption? Is it secure? No. Base64 is encoding, not encryption. Anyone can decode a Base64 string without a secret key, so it does not protect confidential information. Use appropriate encryption and secure transport when confidentiality is required. #### Why does Base64 encoded output end with == or =? Base64 encodes 3 bytes at a time into 4 characters. When the input length is not divisible by 3, the encoder adds `=` padding to make the output a multiple of 4 characters. One `=` means the last group had 2 bytes; two `==` means the last group had 1 byte. If you see no padding, the input length was a multiple of 3. #### Why is the Base64 output larger than the input? Base64 increases data size by approximately 33% (4/3 ratio). For every 3 bytes of input, Base64 produces 4 characters. Additionally, line breaks in MIME-formatted Base64 (every 76 characters per RFC 2045) add a small overhead. This size increase is the trade-off for making binary data compatible with text-only channels. #### Can Base64 encode emojis and non-ASCII characters? Yes. Our tool correctly handles full UTF-8 encoding, including emojis (🚀, 🎉), accented characters (é, ü, ñ), CJK characters (中文, 日本語), Arabic, Hebrew, and all other Unicode text. The input is first UTF-8 encoded to bytes, and those bytes are then Base64-encoded. Make sure to specify UTF-8 on the decoding side as well. #### What is the difference between Base64 and Base64URL? Standard Base64 uses + and /; Base64URL uses - and _ instead. Padding may be omitted when the relevant format permits it. This page outputs standard Base64 and does not automatically convert Base64URL input. #### Is my data safe when using this online Base64 tool? Encoding and decoding run locally in your browser. The page saves entered text in local browser storage and can restore it for 30 days; the stored data may remain until cleared. Use Clear when finished, especially on shared devices, and avoid entering passwords, API keys, or other secrets. #### How do I decode a Base64-encoded image? This decoder is intended for Base64 that represents UTF-8 text; image bytes may fail to decode as text. For images, use an image-specific Base64 tool or a viewer that supports data URLs, and make sure the media type matches the image. #### What are common Base64 decoding errors? Check for invalid characters, malformed padding, or truncated input. This page expects standard Base64 rather than Base64URL, and decoded bytes must be valid UTF-8 text. Whitespace and missing padding may be accepted by your browser, depending on the input. ## Related Tools Discover more free tools that might help with your next task. [URL Decoder Decode URL-encoded strings Use Tool](https://www.toolcomb.com/url-decoder) [HTML Encoder Encode and decode HTML entities Use Tool](https://www.toolcomb.com/html-encoder) [Hash Generator Generate MD5, SHA1, SHA256 hashes Use Tool](https://www.toolcomb.com/hash-generator) [UUID Generator Generate v1, v3, v4, and v5 UUIDs Use Tool](https://www.toolcomb.com/uuid-generator) [Password Generator Generate secure random passwords Use Tool](https://www.toolcomb.com/password-generator) [JWT Decoder Inspect JWT headers and payloads without verifying signatures Use Tool](https://www.toolcomb.com/jwt-decoder) ### Related guides Read the how-to, then come back to this tool when you are ready to run it locally. - [Base64 Is Not Encryption: Encoding vs Secrets Base64 hides nothing. Why people treat it like a cipher, what it is actually for (data URLs, JWTs, APIs), and how to encode or decode in the browser without uploading a key.](https://www.toolcomb.com/blog/base64-is-not-encryption) - [What Is a JWT? How to Decode a Token Without Sharing It Header, payload, signature - decode locally so tokens never hit a website.](https://www.toolcomb.com/blog/what-is-a-jwt-how-to-decode-safely) - [MD5 vs SHA-1 vs SHA-256: What Hashes Are For Hashing vs encryption, collisions, and local checksums.](https://www.toolcomb.com/blog/md5-vs-sha1-vs-sha256-what-hashes-are-for) [View All Tools](https://www.toolcomb.com/tools)