Free Base64 Encode / Decode

Standard Base64 (RFC 4648 Section 4) uses the characters + and / alongside the alphanumeric set, and pads output with =. These three characters are problematic in URLs because + is interpreted as a space, / is a path delimiter, and = is used for query parameters. Base64url (RFC 4648 Section 5, also referenced in RFC 7515 for JWS/JWT) solves this by replacing + with -, / with _, and omitting = padding entirely. JWTs, OAuth tokens, and URL-safe identifiers use Base64url. This tool uses standard Base64, if you need to decode JWT payloads, use the dedicated JWT Decoder tool on this site.

No, Base64 is encoding, not encryption. It provides zero security. Anyone can decode a Base64 string instantly without any key, password, or secret. Base64 simply changes the representation of data from binary to text; it does not obscure or protect the content in any way. Never use Base64 as a security measure. If you need to protect sensitive data, use proper encryption (AES-256, RSA) and transmit it over TLS. Base64 is useful for transport encoding, making binary data safe to include in text formats, but it is not a substitute for encryption.

Base64 appears everywhere in web development. HTTP Basic Authentication encodes the username:password pair as Base64 in the Authorization header. Data URIs use Base64 to embed images, fonts, and SVGs directly in HTML or CSS without a separate HTTP request. Email systems use Base64 via MIME to encode binary attachments. JSON Web Tokens (JWTs) use Base64url to encode their header and payload segments. Kubernetes stores secrets as Base64-encoded values. CI/CD systems like GitHub Actions use Base64 to pass multi-line secrets through environment variables. Even the HTML Canvas API uses Base64 when you call toDataURL() to export an image.

This tool is designed for text-to-Base64 encoding. It does not have a file upload feature that reads binary data. To convert an image to Base64, you would typically use a command-line tool like base64 on macOS/Linux (e.g., base64 -i image.png), a programming language (Python: base64.b64encode(), Node.js: Buffer.from(data).toString("base64")), or a dedicated file-to-Base64 converter. Once you have the Base64 string, you can paste it into this tool to decode it back and verify the round-trip.

A data URI is a scheme defined in RFC 2397 that allows you to embed small files directly in HTML, CSS, or JavaScript as inline text instead of linking to an external URL. The format is data:[mediatype][;base64],<data>. For example, a tiny PNG image can be embedded as data:image/png;base64,iVBORw0KGgo... in an <img> tag or CSS background-image property. Base64 is the encoding that makes this possible, it converts the raw binary file into a text string that can live safely inside a text document. Data URIs are useful for small icons, fonts, and SVGs to reduce HTTP requests, but they increase document size by 33% due to Base64 overhead and are not cached separately by browsers.

The = character is padding used to make the Base64 output length a multiple of 4. Base64 processes input in groups of 3 bytes (24 bits), producing 4 characters of output. If the input length is not a multiple of 3, padding is added: one leftover byte produces two Base64 characters and ==, while two leftover bytes produce three Base64 characters and a single =. The padding tells the decoder exactly how many bytes were in the original input. Some implementations (notably Base64url and certain APIs) strip the padding since the decoder can infer the original length from the output length, but standard Base64 per RFC 4648 always includes it.

Yes, Base64 was specifically designed to encode arbitrary binary data as text. It handles any byte value from 0x00 to 0xFF, which means it can represent images, audio, compressed archives, executables, or any other binary content. This tool focuses on text input, so it encodes your text string as UTF-8 bytes first, then applies Base64 encoding to those bytes. If you need to encode raw binary data (like a file), use a programming language or command-line tool that can read the binary input directly. The Base64 decoding direction in this tool will correctly output the original text from any valid Base64 string.

Base64 encoding does not provide any security, it is trivially reversible by anyone. Never store passwords, API keys, or secrets as "just Base64" and consider them protected. That said, many systems use Base64 as a transport encoding for credentials that are protected by other layers. HTTP Basic Auth Base64-encodes the username:password pair, but security comes from TLS encrypting the connection, not from the Base64 encoding. Kubernetes secrets are Base64-encoded, but access control comes from RBAC policies. Always pair Base64-encoded sensitive data with proper encryption, TLS, and access controls.

HTTP Basic Authentication is defined in RFC 7617 and is one of the simplest authentication schemes for web APIs. The client sends an Authorization header with the value "Basic" followed by the Base64-encoded string of username:password. For example, the credentials admin:secret123 become the header Authorization: Basic YWRtaW46c2VjcmV0MTIz. Base64 is used here not for security but to ensure the credentials, which might contain special characters like colons, spaces, or non-ASCII characters, are transmitted safely over HTTP, which only allows printable ASCII in headers. The actual security comes from sending this header over HTTPS (TLS), which encrypts the entire request in transit.

Yes. The browser's native btoa() function only handles Latin-1 characters (code points 0-255), which causes errors on multibyte characters like emojis or Chinese text. This tool wraps btoa() with a UTF-8 encoding step using TextEncoder and encodeURIComponent/decodeURIComponent, so it correctly handles the entire Unicode range, including emojis, CJK characters, Arabic, Cyrillic, mathematical symbols, and any other script. The round-trip is lossless: encoding and then decoding produces the exact original string, byte for byte.

There is no hard limit imposed by this tool. The practical limit depends on your browser and available device memory. Modern browsers can handle strings of several hundred megabytes, but for very large inputs (10MB+), you may notice a brief delay during encoding or decoding. For typical developer use cases, encoding API keys, credentials, JSON payloads, or small data URIs, the tool handles them instantly. If you need to Base64-encode very large files, a command-line tool or streaming encoder in your programming language of choice will be more memory-efficient.

Both Base64 and hexadecimal are binary-to-text encoding schemes, but they differ in efficiency and use cases. Hex encoding represents each byte as two hexadecimal characters (0-9, a-f), resulting in a 100% size increase, double the original data. Base64 represents every 3 bytes as 4 characters, resulting in only a 33% size increase, making it roughly three times more space-efficient than hex. Hex is simpler and more human-readable, useful for debugging byte values, hash digests (SHA-256, MD5), and color codes. Base64 is preferred when size matters: email attachments, data URIs, authentication headers, and any context where you need compact text representation of binary data.