Privacy Tool

Base64 Encoder & Decoder

Encode text to Base64 or decode Base64 strings back to plain text. Instant, private — runs entirely in your browser.

Plain Text

📁 Upload file

Base64 Output

Quick Actions

Privacy first: All encoding and decoding happens entirely in your browser using JavaScript. Nothing is sent to our servers. Base64 is an encoding scheme, not encryption — do not use it to secure sensitive data.

What is Base64 Encoding?

Base64 is a way of representing binary data (like an image or a file) using only 64 printable ASCII characters — letters, digits, plus “+” and “/”. It doesn’t compress or encrypt anything; it just re-encodes data into a text-safe format that can travel through systems (like email or JSON) that only reliably handle plain text.

Base64 vs Other Encoding Methods

Unlike compression formats (which shrink data) or encryption (which hides it), Base64 actually makes data about 33% larger, since it's trading efficiency for text-safety. Hex encoding is more human-readable byte-by-byte but roughly doubles size instead; URL encoding only escapes specific unsafe characters rather than re-encoding everything, making it better suited for URLs specifically rather than arbitrary binary data.

Common Uses for Base64

Base64 shows up constantly in web development: embedding small images directly in CSS or HTML (data URIs) to avoid extra network requests, encoding attachments in email (MIME), storing binary data in JSON or XML fields that only support text, and encoding credentials in HTTP Basic Authentication headers.

What Base64 is for

Base64 turns any data, including binary files, into plain letters, digits and a few symbols, so it can travel through systems that only handle text: email attachments, JSON fields, data URLs, HTTP headers and configuration files. This tool encodes text or files to Base64 and decodes them back, including the URL-safe variant, and it runs entirely in your browser.

Base64 is not encryption

Anyone can decode Base64 in a second, so it hides nothing. HTTP Basic authentication, for example, sends the username and password as Base64, which is why it must only be used over HTTPS. Never rely on Base64 to protect passwords or API keys; use real encryption, or a password hash such as bcrypt.

Standard or URL-safe?

Standard Base64 uses + and /, and pads the end with =.
URL-safe Base64 uses - and _ instead and often drops the padding, so the result can sit in a URL or file name without escaping. JSON Web Tokens use this form, which you can inspect with the JWT decoder.

Things to know

Size grows by about a third. Every 3 bytes become 4 characters, so Base64 is a poor way to store large files.
Character encoding matters. Text is turned into bytes first, normally as UTF-8. Decoding with a different encoding turns accented letters into garbage.
"Invalid character" errors usually mean the string mixes the two variants, has lost its padding, or picked up line breaks from an email client.

Related Tools

📋

JSON Formatter

Format and validate JSON

🔏

Hash Generator

Generate MD5, SHA-256 hashes

🔍

Regex Tester

Test regular expressions

🔀

🔓

📝

Count words and characters

Frequently Asked Questions

Is Base64 the same as encryption?

No. Base64 is encoding, not encryption. Anyone can decode a Base64 string without any key. Never use it to secure sensitive data — use actual encryption for that purpose.

What is URL-safe Base64?

Standard Base64 uses the characters + and / which have special meaning in URLs. URL-safe Base64 replaces + with - and / with _ so the encoded string can be used safely in URLs and filenames.