Base64 Encode / Decode
Convert text to Base64 and back, with correct UTF-8 handling and an optional URL-safe alphabet.
Output
Paste or type above to see the result here.
Your files stay on your device
This tool runs entirely in your browser. What you paste is processed on your device and is never sent to a server, so it is safe to use with tokens, keys and unpublished text.
Example
Example: a Basic auth header, a JWT header and “Zoë’s café” in URL-safe Base64
A developer testing an API by hand needs an Authorization header for the test account api-user with the password Test-2026, then wants to check a token and a filename. Mode: Encode to Base64, URL-safe off unless said otherwise.
- Type api-user:Test-2026 (name, colon, password) and the Base64 appears as you type: YXBpLXVzZXI6VGVzdC0yMDI2. The header is Authorization: Basic YXBpLXVzZXI6VGVzdC0yMDI2.
- 18 bytes make exactly 24 characters, so there is no = at the end. £25.00 is 7 bytes, because £ takes two in UTF-8, so it makes 12 characters ending in ==.
- “Zoë’s café” is 10 characters but 14 bytes, and its Base64 contains / and +. With URL-safe on they become _ and - and the = is dropped, so it can go in a URL or a filename as it is.
- Switch to Decode and paste eyJhbGciOiJIUzI1NiJ9, the first part of a JWT: it reads {"alg":"HS256"}. No padding is needed, and the - and _ form decodes too.
| Text | UTF-8 bytes | Base64 | URL-safe |
|---|---|---|---|
| Hello | 5 | SGVsbG8= | SGVsbG8 |
| £25.00 | 7 | wqMyNS4wMA== | wqMyNS4wMA |
| Zoë’s café | 14 | Wm/Dq+KAmXMgY2Fmw6k= | Wm_Dq-KAmXMgY2Fmw6k |
| api-user:Test-2026 | 18 | YXBpLXVzZXI6VGVzdC0yMDI2 | YXBpLXVzZXI6VGVzdC0yMDI2 |
| {"plan":"pro"} | 14 | eyJwbGFuIjoicHJvIn0= | eyJwbGFuIjoicHJvIn0 |
| 👍 | 4 | 8J+RjQ== | 8J-RjQ |
Decoding any of these gives the text back exactly, the accents, the curly apostrophe and the emoji included. And the Basic header hides nothing: decode YXBpLXVzZXI6VGVzdC0yMDI2 and the password is there in plain text, so send it only over HTTPS.
How it works
- Choose Encode to turn plain text into Base64, or Decode to turn a Base64 string back into text.
- Paste the input. For decoding, both the standard alphabet with + and / and the URL-safe one with - and _ are accepted; missing padding is tolerated.
- Turn on URL-safe if the result will go into a URL, a JWT or a filename, so no characters need percent-encoding.
- The result appears as you type; copy it. Accented characters, CJK text and emoji are encoded as UTF-8 bytes, matching what btoa-based encoders often get wrong.
Frequently asked questions
- Is Base64 encryption?
- No. Base64 is a reversible encoding that represents bytes using 64 printable characters. Anyone can decode it instantly. Use it for transport and embedding, never for hiding secrets.
- How does the tool handle non-ASCII text like accents, Japanese or emoji?
- The text is converted to UTF-8 bytes before encoding, and decoded output is interpreted as UTF-8. This matches what most languages and HTTP libraries do. Plain JavaScript btoa() only accepts Latin-1, which is why naive encoders throw on such characters.
- What is the difference between standard and URL-safe Base64?
- Standard Base64 (RFC 4648 section 4) uses + and / plus = padding. URL-safe Base64 (section 5) replaces them with - and _ and usually drops the padding, so the string can be used in URLs, cookies and JWTs without escaping. The decoder here accepts both.
- Why is the encoded output about a third longer than my text?
- Base64 packs 3 bytes into 4 characters, so output size is roughly 4/3 of the input plus up to 2 padding characters. That overhead is the price of using only printable characters.
- Can I decode a Base64 image or PDF here?
- No. The decoded bytes are read as UTF-8 text, so a picture or a PDF — a JPEG’s Base64 starts with /9j/, a PDF’s with JVBERi0 — is not turned into a file: the page says it decodes to binary data, not readable text. This page is for text: headers, tokens, configuration values, fields in JSON.
- Why does it say my Base64 is not readable text?
- The bytes were not UTF-8. Text saved as Latin-1 or Windows-1252 stores é as a single byte, so café encoded that way (Y2Fm6Q==) is not valid UTF-8, and the page says so rather than show caf�. The same word encoded here gives Y2Fmw6k=, the UTF-8 form most systems expect.
- Is my data sent to a server?
- No. Encoding and decoding run entirely in the browser. You can convert API keys, connection strings or personal text without anything leaving your device.
Related tools
♭ JWT Decoder Paste a JSON Web Token and read its header and claims. The token never leaves your browser. # Hash Generator Get the MD5, SHA-1 or SHA-2 digest of any text, computed on your device. {} JSON Formatter Paste JSON, get it indented, minified or validated instantly. Your data stays on this page. • UUID Generator Create UUID v4 or v7 identifiers in bulk, generated on your device with a secure random source.