Base64 Encoder-Decoder
Encodes text to Base64 or decodes it back. Supports the standard and URL-safe (base64url) variants and is UTF-8 aware. The conversion happens entirely in your browser; the text is not sent to a server.
Last updated:
Output
Enter text in the field on the left; the result appears instantly.
Where Base64 actually shows up
Reading Basic auth and other opaque header values
An Authorization: Basic header is just base64(user:password), which means it is readable by anything that sees the request. Decoding one demystifies a lot of HTTP debugging, and explains why Basic auth without TLS is plaintext credentials.
Embedding small assets as data URIs
A favicon or tiny SVG inlined into CSS saves a network round-trip at the cost of a one-third size increase. The trade only pays below a few kilobytes; beyond that, the encoding tax outweighs the saved request.
Untangling JWT and webhook payloads
The two readable sections of every JWT are base64url, and many webhook providers wrap their payloads the same way. Recognising which alphabet you are looking at is half the debugging.
Worked example: three characters that break a URL
The difference between the two alphabets sounds academic until a value hits a URL. Three characters demonstrate it.
- Encode Ma? with the standard alphabet: the result is TWE/.
- Put that value into a URL path and the / opens a new path segment; the route silently changes.
- Switch this tool to URL-safe mode: the same three bytes now encode to TWE_.
- Only two alphabet positions differ between the variants: + becomes - and / becomes _.
- This page auto-detects both when decoding, but a strict server-side decoder will reject the alphabet it was not configured for.
Variant mismatches are among the most common integration failures involving Base64, and they are invisible in most test data: a value without characters 62 and 63 encodes identically in both alphabets, so the bug ships and only fires on the unlucky payloads. Agree on the alphabet and the padding policy explicitly, then test with bytes that force a + or /.
Four mistakes worth avoiding
Calling Base64 encryption in a design document
Encoding is reversible by construction and carries no key. The moment a reviewer reads "credentials are encrypted with Base64", the design loses credibility along with its security. Say encoding, and add real encryption where confidentiality matters.
Double-encoding in pipelines
When one layer encodes and a middleware encodes again, a single decode yields something that still looks like Base64. That appearance is the diagnostic: decode twice, then remove the redundant encoding step rather than normalising it away.
Assuming padding is always present
JWT sections drop the = padding; MIME output keeps it; strict decoders differ on whether they demand it. A decoder that throws on JWT input is usually complaining about absent padding, not corrupt data.
Shipping large files through Base64
The 33% inflation applies to memory as well as bandwidth, and both copies of the data live in RAM during conversion. For anything beyond small payloads, multipart uploads or raw binary endpoints are the right channel; Base64 is for embedding, not transport of bulk data.
Tools commonly used alongside this one
- JWT Decoder Decode the header and payload of a JSON Web Token, inspect the standard claims and expiry. The token never leaves your browser.
- HTML / Entity Encoder-Decoder Encode text to HTML entities or decode it back. Escape special characters to prevent XSS; in the browser, no signup.
- CIDR / Subnet Calculator Compute the network address, broadcast, subnet mask, usable host range and address type from CIDR notation.
- Cron Expression Parser Parse a cron expression field by field and see the next run times. For Kubernetes CronJobs and scheduled tasks.
- Epoch / Unix Timestamp Converter Convert Unix epoch timestamps to readable dates and back. Seconds and milliseconds are auto-detected.
Frequently Asked Questions
Is Base64 an encryption method?
No. Base64 is an encoding, not encryption — it provides no confidentiality. Anyone can decode it without a key. Its purpose is to carry binary data safely through text-only channels (URLs, JSON, email, data URIs).
What is the difference between Base64 and base64url?
The standard Base64 alphabet uses + and / as characters 62 and 63 and adds = for padding. base64url replaces those two characters — which are problematic in URLs and file names — with - and _, and usually drops the padding. The three parts of a JWT are base64url-encoded. This tool auto-detects both variants when decoding.
Why does Base64 make data larger?
Base64 turns every 3 bytes into 4 ASCII characters, which is roughly a 33% size increase. That is why Base64 is not efficient for storing or transferring large files — it suits small embedded data (icons, certificates, tokens).
How do I use Base64 in .NET?
Convert.ToBase64String(byte[]) encodes and Convert.FromBase64String(string) decodes. For text, first convert it to bytes with Encoding.UTF8.GetBytes. .NET 9+ adds a Base64Url class that supports the URL-safe variant directly.
Are UTF-8 characters preserved correctly through Base64?
Yes — as long as the text is first converted to UTF-8 bytes. That is exactly what this tool does: text with Turkish, Arabic or emoji characters round-trips faithfully through encode and decode. Wrong encoding (e.g. assuming Latin-1) causes corruption.