Base64 Encode and Decode

Encode and decode Base64 in your browser, with correct handling of accents and emoji.

Free, no limit Nothing uploaded Works offline No sign-up

Base64 is an encoding, not encryption

Worth saying first because it is the most consequential misunderstanding about this format. Base64 hides nothing. Anyone can decode it instantly, with no key and no effort, and this page is proof of that. It exists to move binary data safely through channels that expect text, not to protect anything.

What it does is represent arbitrary bytes using 64 characters that survive email headers, URLs, JSON strings and configuration files without being mangled. That is why it turns up in data URIs, JWT tokens, email attachments and API credentials.

The cost is size. Base64 encodes three bytes as four characters, so the result is always about a third larger than what went in. The trailing equals signs are padding to make the length a multiple of four.

Text being encoded into Base64 and decoded back again

How to use it

Paste into the left box and the result appears in the right one as you type. Change any option and it recalculates immediately.

Copy puts the result on your clipboard and confirms it did. Download saves it as a file, which is the easier route when the output is long enough that selecting it by hand is a nuisance. Clear empties the boxes and puts the cursor back where you need it.

Where a sample button appears, it loads a small realistic example. It is there so you can see what the tool expects before pasting your own material, which is quicker than reading a description of the input format.

Keyboard and mobile

The text areas are ordinary form fields, so every shortcut your system already has works: select all, undo, redo, and paste without formatting. Tab moves between the panes and the controls in the order you would expect, and every control is reachable without a mouse.

On a phone the panes stack rather than sitting side by side, and the text areas grow to a comfortable height. Spellcheck and autocorrect are switched off in them, because a tool that silently capitalises your base64 encoder input is worse than useless.

If something looks wrong

When the result is not what you expected, the message under the boxes is the first thing to read. It reports what happened rather than a generic failure, so a malformed input names the line to look at and a successful run reports what it did, such as how many lines it kept or how many replacements it made.

A count of zero is informative in itself. It usually means the input did not contain what you thought it did, most often because of capitalisation or an invisible trailing space, both of which are far more common in pasted data than people expect.

Nothing is corrected silently. If the input cannot be handled, the output is left empty and the reason is stated, rather than a partial result being returned that looks plausible and is wrong. A tool that guesses is worse than one that says it could not.

Unicode, where most encoders break

The browser's own btoa function only handles characters below 256, so it throws an error on an accent and on every emoji. A great many online encoders are a thin wrapper around it and fail the same way.

  • This one encodes the text as UTF-8 first, so accents, Cyrillic, Chinese and emoji all encode and decode correctly.
  • Decoding reverses that, reading the bytes back as UTF-8, so you get your original text rather than a string of question marks.
  • Whitespace is ignored when decoding, because Base64 in emails and PEM files is wrapped across lines.

If you are decoding a JWT, note that it uses a URL safe variant with dashes and underscores in place of plus and slash. Swap those back before decoding, and be aware that a JWT signature is not readable text.

Which encoding for which job

The three encodings on this site solve different problems and are not interchangeable. Using the wrong one produces output that looks encoded and fails in a way that can take an afternoon to find.

EncodingUse it forEscapesGrows by
Base64Binary data in a text channelEverythingAbout 33 percent
Percent, URLValues inside a URLReserved charactersVaries
HTML entitiesText placed into markupFive charactersSlightly

Base64 is for bytes that are not text at all: an image in a data URI, a certificate in a PEM file, an attachment in an email. It is not for making text safe, and it protects nothing.

Percent encoding is for URLs specifically, and even within a URL the rules differ between a path segment and a query value. It exists because a URL reserves punctuation for structure, so a value containing that punctuation has to be escaped or the address means something else.

HTML entities are for text going into markup, so that a less than sign stays a less than sign instead of opening a tag. This is the encoding that stops user supplied text becoming executable, and it is applied at the moment of output, not when the data is stored.

The rule that avoids nearly every bug: encode at the boundary, once, for the destination the text is entering. Encoding early, or twice, is how you end up with visible entity codes and double escaped URLs in production.

Safe to use with real data

Most online developer tools post whatever you paste to a server. For a toy example that is fine. For the payload you are actually debugging, which is a production API response with customer records in it, an internal configuration file or a token, it is a data disclosure that nobody signed off.

Everything on this page runs in your browser. The parsing, the conversion and the formatting all happen in memory on your own machine. Nothing is transmitted, nothing is logged, and there is no server that could keep a copy even if someone asked it to.

You can check that yourself: open your browser's network panel, paste something in and watch nothing happen. Then disconnect from the internet and use the base64 encoder tool anyway, because once the page has loaded it does not need the network again.

That constraint also shapes what we will build. Anything that genuinely requires a server, such as looking up a value in a database, is not something we can offer honestly under these terms, so we do not offer it at all.

No limits, and no account

There is no cap on how much text you can run through this, no daily quota and no sign up wall at the point where it becomes useful. The Base64 Encoder tool costs us nothing to provide because it runs on your device rather than ours, so there is nothing to meter.

There is also nothing to install. It is one page of HTML, one stylesheet and one script, which together come to a fraction of the weight of a single photograph. It loads in well under a second on a phone connection and works immediately.

Why we built it this way

Developer tools that upload your input are a poor bargain. You get a conversion and they get your data, and the thing you pasted was usually the one piece of text you should have been most careful with. Running it locally removes the trade entirely.

The whole site is built on the same rule: if the work can be done in the browser, it is done in the browser. Over a hundred tools work that way, and the handful that genuinely cannot are the ones we have not built.

It also means the tool keeps working when we are not paying attention to it. There is no service to go down, no API key to expire and no rate limit to hit at the moment you need it most. The page you loaded is the whole program, and it will behave the same way in five years as it does today.

FAQ

Base64 Encoder

The questions people ask most about this tool.

No, and it is not meant to be. It is a way of representing bytes as text, and anyone can decode it in a second. Never use it to hide a password or a key.

Base64 represents every three bytes as four characters, so the output is about 33 percent larger. That is the cost of using only characters that survive text channels.

Padding. The encoded length has to be a multiple of four, so one or two equals signs are added when the input length is not a multiple of three.

Yes. The text is encoded as UTF-8 first, which is what the browser's built in function fails to do and why so many online encoders break on anything outside plain English.

Completely, with no account, no quota and no paid tier. It runs on your own device, so there is nothing for us to meter and nothing to charge for.

No. Everything happens inside this page, in memory on your machine. Nothing is transmitted, stored or logged, and you can confirm it by watching your browser's network panel while you type.

Yes. Once the page has loaded it never needs the network again, so you can disconnect and carry on working.

None that we impose. The practical limit is your device's memory, which on a modern machine is a very large amount of text.

Yes. The panes stack on a narrow screen and the controls stay reachable. Autocorrect is switched off in the input, so nothing is silently changed as you type.

Yes, freely and with no attribution required. What you paste is yours and so is what comes out.
More tools

Other developer tools

Same engine, different job. Every one runs in your browser.

All developer tools

JSON to CSV

Flatten nested JSON into a spreadsheet ready CSV.

CSV to JSON

Turn a CSV file into typed JSON records.

JSON to XML

Convert JSON documents into valid XML.

XML to JSON

Parse XML into clean, readable JSON.

JSON Formatter

Pretty print, minify and validate JSON.

YAML to JSON

Convert YAML config files into JSON.

JSON to YAML

Convert JSON into readable YAML.

URL Encoder

Percent encode and decode URLs and query strings.

Need a different conversion?

Over a hundred free tools, all running in your browser. Nothing is uploaded and nothing is capped.

Browse all tools Contact us