Base64
Convert text to and from Base64, including a URL-safe variant.
Output will appear here
What Base64 is and why it exists
Base64 is a way to represent any binary data using only 64 plain, printable characters: A–Z, a–z, 0–9, plus two symbols. It exists because many systems were built to carry text, not raw bytes. Email bodies, URLs, JSON strings, HTML attributes and HTTP headers can all be corrupted by arbitrary binary content, but they happily pass Base64 text through unchanged. Encoding to Base64 makes binary data safe to embed in those text-only channels.
The trade-off is size: Base64 represents every three bytes as four characters, so the encoded form is about 33% larger than the original. That is fine for small payloads like tokens, small images or keys, and is the reason large files are rarely Base64-encoded in practice.
It is encoding, not encryption
This is the single most important thing to understand about Base64: it provides no security whatsoever. Anyone can decode Base64 instantly — including this tool. It hides nothing and protects nothing. If you need to keep data secret, encrypt it; Base64 only makes data transport-safe, and encoding a password or API key does not conceal it.
Standard vs. URL-safe Base64
Standard Base64 uses + and / as its last two characters and pads the end with = signs. Those characters have special meaning inside URLs and filenames, so a URL-safe variant swaps + and / for - and _ and usually drops the padding. Use the URL-safe option when the encoded value will appear in a web address, a query parameter, a cookie or a filename. JSON Web Tokens, for example, use URL-safe Base64 for exactly this reason.
UTF-8 and non-ASCII text
The browser's built-in btoa and atob functions only handle Latin-1 and throw on characters like Hebrew, Arabic, Chinese or emoji. This tool encodes text as UTF-8 first, so any character round-trips correctly. That means שלום and 😀 encode and decode without corruption — a common source of "mojibake" (garbled text) when developers reach for the raw browser functions.
- Encode: type or paste readable text and get its Base64 form.
- Decode: paste Base64 (standard or URL-safe, with or without padding) and get the original text back.
Frequently asked questions
- Is Base64 secure or encrypted?
- No. Base64 is a reversible encoding, not encryption. Anyone can decode it instantly, so never use it to protect passwords, keys or personal data.
- Does it support Hebrew, Arabic and emoji?
- Yes. Text is encoded as UTF-8 before Base64, so characters like שלום and 😀 encode and decode without corruption, unlike the browser's built-in btoa function.
- What is URL-safe Base64?
- It replaces the + and / characters with - and _ and drops the trailing padding, so the result can be used safely inside URLs, query strings, cookies, filenames and tokens such as JWTs.
- Why is my decoded output empty or wrong?
- Usually the input is not valid Base64 — it may be truncated, contain characters from a different alphabet, or actually be plain text. The tool accepts both standard and URL-safe input and tolerates missing padding, but the bytes still have to be valid UTF-8 to display as text.
- Why is the encoded string longer than the original?
- Base64 encodes every three bytes as four characters, so the output is roughly one-third larger than the input. This overhead is inherent to the format.
- Do I need the padding characters (=)?
- Padding makes the length a multiple of four and is required by strict decoders, but this tool accepts input with or without it. URL-safe Base64 typically omits padding.
- Is my input sent to a server?
- No. Encoding and decoding run entirely in your browser; nothing you paste leaves your device.