Base64 Encoder / Decoder
Free tool · by Daniel HaketEncode text to Base64 or decode any Base64 back to readable text — full UTF-8 support, entirely in your browser. And remember the golden rule: Base64 is encoding, not encryption.
Full UTF-8 support (emoji, accents). Runs entirely in your browser — and remember: Base64 is encoding, not encryption.
What this free tool is great for: a quick, one-off job with no signup — it runs entirely in your browser, so nothing leaves your device and there's nothing to manage.
Its honest limit: it produces a one-off output — it won't store, track, brand or manage them at scale, and it can't tell you what happens after you share it.
What Base64 actually is
Base64 is a way to write any data — text, images, files, bytes of every kind — using only 64 safe, printable characters: letters, digits, plus, slash. It exists because many of computing's oldest channels (email protocols, XML, URLs, JSON) were built for plain text and choke on raw binary bytes. Base64 is the diplomatic passport that lets arbitrary data travel through text-only territory unharmed: three bytes of anything become four safe characters, and the receiver reverses the trick losslessly. That's the entire idea — a transport encoding. Everything confusing about Base64 comes from forgetting that sentence, starting with the security misconception the next section exists to kill.
Encoding is not encryption — the misconception that leaks secrets
Base64 output looks scrambled, and that resemblance causes real security incidents. It is not encryption: there is no key, no secret, nothing to crack — decoding is a single function call available in every browser console. Yet credentials "hidden" in Base64 turn up constantly: API keys in config files, passwords in HTTP Basic Auth headers (which are literally Base64 by spec, which is why Basic Auth requires HTTPS), tokens in mobile apps. The rule to internalise: Base64 hides data from parsers, not from people. If a human shouldn't read it, you need actual encryption; if a system just needs it to survive transport, Base64 is the right tool. Confusing the two is how secrets end up public while feeling protected.
Where you meet it daily
Once you recognise the shape (blocks of letters and digits, often ending in = or ==), Base64 is everywhere. Email attachments travel as it — MIME encodes every file you've ever mailed. Data-URIs embed images directly in CSS and HTML (data:image/png;base64,…), saving a network request for small icons. JSON Web Tokens are three Base64 chunks joined by dots — paste any JWT's middle section into this decoder and read your own session claims in plain JSON. API payloads carry file uploads as Base64 strings. Certificates and keys in PEM format wrap Base64 between BEGIN/END lines. Debugging modern systems without being able to decode Base64 on sight is working with one eye closed.
The cost: size and when not to use it
The safety has a price: Base64 output is one-third larger than its input — every 3 bytes become 4 characters. For a small icon inlined in CSS, irrelevant; for large images or files, that 33% is real bandwidth and memory, which is why "should we Base64 this upload?" is usually answered "no, use a proper binary upload". The overhead also compounds sneakily: Base64-inside-JSON-inside-Base64 happens in real systems and doubles the bloat. Treat it as duct tape for text-only channels — excellent at its job, wrong as a default. When a channel supports binary natively (multipart uploads, gRPC, plain files), let it.
UTF-8, emoji and the classic JavaScript trap
The browser's built-in btoa() function predates emoji and throws errors on anything outside Latin-1 — the classic "Character Out Of Range" bug that greets every developer who Base64s user input containing an é, a €, or a 😀. The correct dance, which this tool performs for you, is encoding text to UTF-8 bytes first, then Base64ing those bytes (and the reverse on decode). This matters beyond convenience: two tools that disagree on the pre-encoding produce different Base64 for the same text, which is usually the explanation when "the same string" fails a comparison across systems. When Base64 mismatches, suspect the text encoding underneath before suspecting the Base64.
Reading and repairing Base64 by hand
Practical decoder-side knowledge. The trailing = signs are padding — they mark that the original byte count wasn't divisible by three, and some systems omit them (URL-safe variants), which strict decoders reject; re-adding padding to a multiple of four often fixes "invalid input". URL-safe Base64 swaps + and / for - and _ so the string survives inside URLs — translate them back before standard decoding. Line breaks inside long Base64 (email wraps at 76 characters) are harmless and stripped by this tool. And when a decode produces gibberish rather than an error, you've likely decoded binary data (an image, a zip) as text — which is correct behaviour on incorrect assumptions.
A five-second debugging superpower
The habit that pays daily: when an opaque blob appears in a log, a header, a webhook payload or a config — decode it. Half the time it's readable JSON or a URL that explains exactly what the system was doing. Session tokens reveal their expiry; error payloads reveal their cause; "encrypted" fields reveal that they were never encrypted at all (see the misconception above — you'll find violations in the wild within a week of looking). This tool makes that reflex frictionless and private: the tokens and payloads you inspect stay in your browser, which matters because the things worth decoding are usually the things you least want pasted into a stranger's server.
Base64 in configuration and secrets management, done right
There is one legitimate place Base64 and secrets meet: configuration plumbing. Kubernetes secrets, environment files and certificate bundles often require Base64 wrapping — not for protection, but because the transport layer demands text-safe payloads. The professional distinction: the wrapping is fine when the storage itself is protected (encrypted at rest, access-controlled), and negligent when the Base64 blob sits in a public repo or a shared doc. The code-review habit that catches real incidents: any time you see a Base64 string in committed config, decode it and ask what it is — the answer is depressingly often a live credential that someone believed was hidden by the alphabet soup.
Decoding blobs is step one — where NordVPN does more
Understanding Base64 sharpens exactly the instinct this tool serves: knowing what actually protects data (encryption) versus what merely reformats it (encoding). The same distinction applies to your connection: HTTPS encrypts traffic to each site, but on public Wi-Fi the network still sees every domain you visit, and hostile networks can redirect and probe. That's where NordVPN does more: an encrypted tunnel for everything you send, threat protection that blocks malicious sites and downloads, and the baseline privacy that makes coffee-shop work not a gamble. Decode with confidence here; browse with actual encryption there — and never again mistake the one for the other.
Frequently asked questions
Is Base64 encryption?
No — it's a reversible transport encoding with no key and no secret; anyone can decode it instantly. Never use it to hide credentials or sensitive data. If a human shouldn't read it, you need real encryption.
Why do some Base64 strings end in = or ==?
Padding: it marks that the original byte count wasn't divisible by three. Some variants omit it — if a decoder rejects a string, re-adding = to a multiple of four often fixes it.
Why does my emoji or accented text fail in other tools?
The browser's raw btoa() predates Unicode and errors outside Latin-1. This tool encodes text to UTF-8 bytes first (and reverses it on decode), which is the correct, portable approach.
Does my data leave the browser?
No — encoding and decoding run locally. That matters because the things worth decoding (tokens, payloads, headers) are exactly what you don't want on a stranger's server.
More free generators & utilities
Embed this tool on your site
Blogger, teacher or toolmaker? Put this calculator on your own page — free forever, no strings. Copy the snippet below (the credit link is appreciated and keeps the tool free):
This tool is free and runs entirely in your browser. The link above is an affiliate link: we may earn a commission if you sign up, at no extra cost to you, and it never changes our honest take.