Base64 Encoder/Decoder

Practical Example

Encode a short config value or API sample before pasting it into a document, then decode the received Base64 value to confirm the original text was not damaged. For example, encode hello:1234, copy the result, and decode it later for verification.

What is Base64?

Base64 is an encoding scheme that converts binary data into ASCII text using 64 printable characters (A-Z, a-z, 0-9, +, /). Standardized in RFC 4648, it is used wherever binary data must travel through text-only channels: email attachments (MIME), JWT tokens, Data URIs, HTTP Basic Authentication, and API payloads.

A critical distinction: Base64 is encoding, not encryption. Anyone can decode it to recover the original data. Never use Base64 alone to protect sensitive information — use AES, RSA, or other encryption algorithms for security.

All processing in this tool runs in your browser using JavaScript's btoa()/atob() functions. No data is sent to any server.

How Base64 Works

Base64 splits input into 6-bit groups and maps each to one of 64 characters. Three input bytes (24 bits) become four Base64 characters, resulting in roughly 33% size increase. When input length isn't a multiple of 3, padding characters (=) are appended: one = for 2-byte input, two == for 1-byte input.

Standard vs URL-safe Base64

Standard Base64 (RFC 4648 §4) uses + and /, which conflict with URL syntax — + means space and / is a path separator. URL-safe Base64 (RFC 4648 §5) replaces them with - and _, and typically omits padding. JWT tokens, OAuth parameters, and filename-safe encoding all use the URL-safe variant.

Practical Use Cases

JWT Token Inspection — JWT consists of three Base64url-encoded segments separated by dots. Decoding the Payload segment reveals claims like user ID, expiration (exp), and issued-at (iat) timestamps for quick debugging.

Data URIs — Small images can be inlined as data:image/png;base64,... in HTML/CSS, reducing HTTP requests. Best for icons under 2-5 KB; larger assets should remain as separate files for caching benefits.

HTTP Basic Authentication — The Authorization: Basic header contains username:password encoded in Base64. Always use HTTPS — Base64 provides no confidentiality.

API Payloads — When uploading images via JSON APIs, file content can be Base64-encoded into a string field. Simpler than multipart forms, but the 33% size overhead makes it unsuitable for large files.

Important Caveats

Not encryption — Anyone can decode Base64. Never rely on it alone for passwords, API keys, or sensitive data.

Size overhead — Output is ~33% larger than input. For large files, consider multipart upload or pre-signed URLs instead.

Padding inconsistency — MIME requires padding (=); JWT omits it. Padding mismatch is a common cause of decode failures.

Line break handling — MIME Base64 inserts line breaks every 76 characters; URL-safe Base64 uses no line breaks. Mixing conventions causes errors.

Three Base64 Variants — Which One Do You Have?

A large share of "Base64 won't decode" problems are variant mismatches.

Decoding a JWT with a standard decoder fails on - and _; feeding URL-safe strings to strict standard decoders fails the same way. When decoding fails, check for +/= characters first.

Inspecting a JWT with This Tool

A JWT is header.payload.signature joined by dots, and the first two parts are URL-safe Base64. Split on the dots, paste the payload, and you can read the expiry (exp), issuer (iss), and permission claims immediately. Two caveats: the signature part is raw binary and will not decode to text, and decoding is not decryption — anyone can read a JWT payload, which is exactly why secrets must never be stored in one. Encoding internals are covered in the Base64 guide.

FAQ