Base64 Encoder & Decoder
Encode plain text to Base64 or decode Base64 back to text. Live output as you type. Supports Unicode, Arabic, emoji, and all scripts.
Base64 output (click to copy)
What is Base64 encoding?
What it is
Base64 is a binary-to-text encoding that converts data into a safe ASCII string using 64 printable characters (A–Z, a–z, 0–9, +, /).
Common uses
Embedding images in HTML/CSS, passing data in URLs, encoding API credentials in HTTP headers, storing binary data in JSON.
Not encryption
Base64 is encoding, not encryption. Anyone with the encoded string can decode it. Never use it to secure sensitive data.
How to Use the Base64 Encoder/Decoder
- Choose encode or decode — Encode converts text/binary to Base64 string. Decode converts a Base64 string back to the original text.
- Enter your input — paste the text to encode, or the Base64 string to decode.
- Select URL-safe mode if needed — standard Base64 uses + and / characters which are special in URLs. URL-safe Base64 replaces these with - and _ for safe use in URLs and filenames.
- Copy the result — use the copy button for the encoded/decoded output.
- Encode files — for binary data like images, use the file upload option to encode to Base64 for embedding in HTML or CSS.
📌 Quick reference: Base64 encoded output is always approximately 33% larger than the input. A 3KB image becomes approximately 4KB in Base64. This size increase is the trade-off for making binary data safe for text-based protocols like email and HTTP headers.
Understanding Base64 Encoding
🔢 What Is Base64?
An encoding scheme that converts binary data to a text string using 64 printable ASCII characters (A-Z, a-z, 0-9, +, /). The '64' refers to these 64 characters. It is an encoding scheme, not encryption — Base64 is trivially reversible and provides zero security.
🎯 Why Base64 Exists
Many protocols (email, HTTP headers, URLs) were designed for text only. Binary data — images, files, audio — cannot be safely transmitted through these channels. Base64 converts any binary to safe ASCII text, making binary transmission possible over text-only protocols.
📊 How It Works
Takes 3 bytes (24 bits) of binary input at a time, splits into four 6-bit groups, maps each group to one of 64 characters. Three input bytes → four output characters. This 3:4 ratio creates the ~33% size increase. Padding (=) is added if input length is not divisible by 3.
🌐 URL-Safe Base64
Standard Base64 uses + and / which are special characters in URLs. URL-safe Base64 (Base64url) replaces + with - and / with _ making it safe for URL parameters, filenames, and JWT tokens without percent-encoding.
🖼️ Common Uses
Embedding images in HTML/CSS (data URIs). Email attachments (MIME encoding). Basic Auth HTTP header (username:password encoded). JWT (JSON Web Token) payload encoding. Storing binary data in JSON. Embedding fonts in CSS. API keys and tokens.
⚠️ Not Encryption
Base64 is frequently confused with encryption. Anyone who sees Base64 output can decode it instantly. It provides no security — only format conversion. Adding Base64 to a string does not make it secret. Use actual encryption (AES, RSA) if security is required.
Base64 in Web Development
Data URIs for images
Base64 encoding allows embedding images directly in HTML or CSS, eliminating the HTTP request for the image file. `
` — the entire image is inline. Benefits: one fewer HTTP request, works in email clients that block external images. Drawbacks: increases HTML size, not cached separately by browsers. Ideal for small icons (under 2KB); avoid for large images.
JWT tokens
JSON Web Tokens (JWTs) use Base64url encoding for their header and payload sections. A JWT like eyJhbGciOiJIUzI1NiJ9.eyJ1c2VyIjoiZmFyaGFuIn0.signature has three Base64url-encoded parts separated by dots. The header and payload are trivially decodable — they are not encrypted. Only the signature verifies authenticity. Never store sensitive data in JWT payloads.
Basic authentication
HTTP Basic Authentication sends credentials as Base64(username:password) in the Authorization header: `Authorization: Basic dXNlcjpwYXNzd29yZA==`. This is not secure on its own — the credentials are trivially decoded. Basic Auth must always be used over HTTPS to prevent credential interception. For production APIs, prefer API keys or OAuth tokens over Basic Auth.
🔧 Command line Base64: Linux/Mac: `echo -n 'hello' | base64` encodes. `echo 'aGVsbG8=' | base64 -d` decodes. Windows PowerShell: `[Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes('hello'))`. These commands are useful for quick encoding in scripts and CI/CD pipelines without needing a browser tool.
Frequently Asked Questions
What is Base64 encoding?
Base64 converts data into a set of 64 printable ASCII characters (A–Z, a–z, 0–9, +, /). It's used to transmit binary data over text-based channels such as email and HTTP.
What are common uses for Base64?
Embedding images in HTML/CSS as data URLs, encoding API credentials in HTTP Authorization headers, storing binary data in JSON payloads, and MIME encoding for email attachments.
Is Base64 the same as encryption?
No. Base64 is encoding, not encryption. Anyone can instantly decode a Base64 string — it provides zero security. Never use it to protect sensitive data.
Why does Base64 output end with = or ==?
Base64 encodes every 3 bytes into 4 characters. If the input length isn't a multiple of 3, padding characters (=) are added at the end.