HandyTools Hub

Base64 Encoder/Decoder

Encode text to Base64 or decode Base64 to text. Supports UTF-8.

Try it with a real conversion

Encode text, not a password

Text to encode

hello

Base64 result

aGVsbG8=

Base64 is not encryption

Anyone can decode Base64. Do not use it to protect passwords, tokens, or other secrets.

Read how Base64 works

This Base64 encoder and decoder converts text to Base64 and back, with full UTF-8 support for international characters. Paste a value and read it immediately — the tool also handles the Base64url variant used by JWTs and the whitespace that sneaks into copied strings. It is for developers embedding data in URLs or HTML, debugging API payloads, decoding Basic Auth headers, and anyone who has found a mysterious aGVsbG8= string and wants to know what is inside.

How to Use

  1. Enter text or a Base64 string into the input field. Pasting multi-line content is fine — stray newlines and spaces are handled automatically.
  2. Choose a direction: Encode turns readable text into Base64, Decode turns Base64 back into text. Invalid input is flagged with a clear message rather than a silent failure.
  3. Check the output. The conversion is instant, so you can edit the input and watch the result update without pressing anything.
  4. Copy the result to your clipboard with one click, ready for a header value, a data URI, or a config file.

Worked Examples

Example 1 — the textbook case. Encoding the string Man produces TWFu. The three ASCII bytes for M, a, and n are 77, 97, and 110; concatenated in binary they form 24 bits, which split into four 6-bit values (19, 22, 5, 46) that map to T, W, F, and u in the Base64 alphabet. Because the length divides evenly by three, no padding is needed.

Example 2 — padding in action. Encoding M alone yields TQ== and encoding Ma yields TWE=. One leftover byte becomes two characters plus ==; two leftover bytes become three characters plus =. The equals signs carry no data — they tell the decoder that the final group was short.

Example 3 — decoding a token. A JWT’s middle segment looks like eyJzdWIiOiIxMjM0NSJ9. Pasting it into the decoder returns {"sub":"12345"} — proof that the payload of a JWT is just Base64url-encoded JSON, readable by anyone holding the token, not encrypted.

How Base64 Works

Many transport systems were designed for text: early SMTP guaranteed only 7-bit ASCII, and formats such as JSON, XML, and URLs reserve characters that cannot appear raw. Push arbitrary binary through those channels and the data gets mangled or truncated. Base64 avoids that by representing binary data using only 64 printable characters.

The encoding processes input in groups of 3 bytes (24 bits) and splits each group into four 6-bit values. Six bits can express 0–63, exactly the size of the alphabet: A–Z (0–25), a–z (26–51), 0–9 (52–61), + (62), and / (63). When the input does not divide evenly by three, one or two = characters pad the final group so the output length stays a multiple of four.

The cost is a fixed 33% size increase, because 3 bytes become 4 characters. That is why inlining a large photograph as a data URI is a poor trade: the file grows by a third, and the browser must download the whole document before it can decode and render.

The URL-Safe Variant

Standard Base64 uses + and /, both of which have special meanings in a URL (+ decodes to a space in query strings). RFC 4648 therefore defines Base64url: - replaces +, _ replaces /, and trailing = is usually omitted. JSON Web Tokens, many OAuth flows, and URL parameters carrying binary data all use it. If a string fails to decode and contains - or _, convert it back to standard Base64 first.

Common Mistakes and Edge Cases

  • Treating Base64 as encryption. It is a representation, not protection. There is no key; anyone can decode it in milliseconds. Storing a password or API key as Base64 hides it from nobody.
  • Double encoding. Encoding an already-encoded string turns %20-style artifacts into larger ones and makes the value undecodable by the next system. Encode exactly once, at the boundary where it is required.
  • Assuming it shortens data. It always grows the payload by about a third. Use compression when size matters.
  • Forgetting the data URI prefix. Base64 alone is not a usable image in HTML; you need data:image/png;base64, in front. The Image to Base64 tool builds that for you.
  • Mixing variants. A string with -/_ will not decode in a strict standard decoder, and a +// string will break a URL-safe parser. Know which variant your consumer expects.
  • Line wrapping. Some formats wrap Base64 at 76 characters (MIME); others expect an unbroken string. The decoder here ignores whitespace, so both work on input — but the consumer of your output may not be so forgiving.

Features

  • Encode text to Base64 and decode it back, with strict validation
  • Full UTF-8 support, including Chinese, emoji, and other multi-byte content
  • Handles Base64url strings and ignores stray whitespace automatically
  • Instant, client-side conversion with a one-click copy
  • Works offline — no server, no logging, no storage

Use Cases

  • Data URLs: Inline small icons directly into HTML and CSS.
  • Basic Auth: Build Authorization: Basic headers for API testing over HTTPS.
  • API debugging: Decode payloads from JWTs, webhooks, and message queues.
  • Text-only channels: Carry binary or special-character data through email, JSON, or logs safely.

Frequently Asked Questions

Why does my Base64 string contain - and _ instead of + and /?

You are looking at Base64url, a URL-safe variant defined in RFC 4648. It swaps + for - and / for _, and usually drops the trailing = padding, so the string can travel inside a URL or a filename without being percent-encoded. JSON Web Tokens use it. To decode a Base64url string in a standard decoder, replace - with +, _ with /, and re-add padding to a multiple of four characters.

Can I Base64-encode a file, not just text?

This tool works on text. For images, use the Image to Base64 converter, which reads the binary file, applies the same encoding, and returns a complete data URI with the correct MIME type. The underlying math is identical — 3 bytes to 4 characters — but a file needs a MIME prefix to be useful in HTML or CSS.

Does Base64 compress or shorten data?

No, it does the opposite: encoded output is always about 33% larger than the input. Base64 trades size for safe transport. If your goal is a smaller payload, use compression (gzip or Brotli) or a more compact format — never Base64.

Why do I get an error when decoding?

Decoding fails when the input contains characters outside the Base64 alphabet, when its length is not a multiple of four (after accounting for padding), or when it is actually a Base64url string with - and _. Whitespace and stray newlines are ignored automatically, so the usual culprit is a missing or extra character from a copy-paste.

Is Basic Auth with Base64 safe?

Only over HTTPS. The Authorization: Basic header encodes username:password in Base64, which is trivially reversible — anyone who intercepts it reads the credentials instantly. Base64 adds no security; the TLS layer is what protects the request. Never send Basic Auth over plain HTTP.

What is the maximum input size?

The tool handles inputs up to roughly 1 MB comfortably, which covers typical API payloads, tokens, and configuration snippets. For very large files, encoding in the browser becomes slow and memory-hungry; process those in a script with a streaming encoder instead.

Reviewed by the HandyTools Hub team · Last updated