Base64 Encoder / Decoder

Base64 Encoder / Decoder

Base64 is a way of representing arbitrary binary data using only 64 printable ASCII characters (A-Z, a-z, 0-9, +, /), so it survives transport through systems that only reliably handle text — email (MIME attachments), URLs (data: URIs embedding an image directly in HTML or CSS), HTTP headers (the "Basic" Authorization scheme encodes "user:password" this way), and the header/payload segments of a JWT. Every 3 raw bytes become 4 Base64 characters, so an encoded string is always about a third longer than the original; a trailing "=" or "==" pads the output when the input length isn't a multiple of 3.

The browser's native functions for this, btoa() and atob(), only understand Latin-1 (single-byte) characters — calling btoa() directly on a string containing "café" or "日本語" throws an exception, which is a common gotcha for anyone reaching for Base64 in a hurry. This tool avoids that entirely: on encode, your text is first turned into its UTF-8 byte representation (via TextEncoder), then those bytes are Base64-encoded; on decode, the reverse happens (TextDecoder, rejecting anything that isn't valid UTF-8 rather than silently returning garbled characters). That means full round-trip support for any Unicode text, not just plain ASCII.

Decoding fails cleanly in two distinct ways, and this tool tells you which one happened: the input might not be valid Base64 at all (wrong length, or a character outside the standard alphabet — checked before attempting to decode), or it might be syntactically valid Base64 that decodes to bytes which aren't valid UTF-8 text (for example, Base64 of a JPEG image, or of a JWT signature, which is raw binary, not text). The second case is expected and not a bug in this tool — those bytes were never meant to be read as text in the first place.

One important variant this tool does NOT use directly: Base64URL, a filesystem/URL-safe alphabet that replaces "+" and "/" with "-" and "_" and drops padding — used by JWTs and some OAuth flows precisely because standard Base64's "+" and "/" characters have special meaning in a URL. If you're trying to decode a JWT's header or payload segment, use the dedicated JWT decoder instead — it applies the Base64URL-to-Base64 conversion for you automatically.

Glossary

Base64

An encoding scheme that represents binary data using 64 printable ASCII characters, so it survives being carried through text-only channels like email or URLs.

MIME

Multipurpose Internet Mail Extensions — the standard that defines how email messages carry non-text content (attachments, images), typically Base64-encoded.

UTF-8

The dominant variable-length byte encoding for Unicode text — what this tool uses to turn your text into bytes before Base64-encoding them.

Padding character (=)

One or two trailing "=" characters that pad a Base64 string out to a multiple of 4 characters when the input length isn't a multiple of 3 bytes.

Base64URL

A URL/filesystem-safe variant of Base64 (RFC 4648 §5) that replaces "+"/"/" with "-"/"_" and drops padding — used by JWTs and some OAuth tokens.

data: URI

A URL scheme that embeds a resource's content directly inline (e.g. "data:image/png;base64,...") instead of linking to it — commonly used to inline small images in HTML or CSS.

API equivalent

This tool has no API equivalent in our service — Base64 encoding isn't an IP-address fact, so there's nothing for our API to return here. The conversion above runs entirely on your device; nothing is ever sent anywhere. If you're looking for our IP-lookup API instead, it covers geolocation, ASN/network and threat/fraud data for an IP address:

Read the full API docs

Related tools

• All developer tools
• JWT Decoder
• Hash Generator (MD5/SHA-1/SHA-256)

Frequently asked questions

What is Base64 encoding used for?

Carrying binary or non-ASCII data through channels that only reliably handle plain text — email attachments (MIME), data: URIs embedding images in HTML/CSS, HTTP Basic Authorization headers, and the header/payload segments of a JWT.

Does Base64 encrypt or protect my data?

No — Base64 is an encoding, not encryption. Anyone can decode it back to the original text instantly, with no key or password required. Never use Base64 alone to protect secrets; use real encryption for that.

Why did decoding fail with an error?

Either the text isn't valid Base64 at all (wrong length, or characters outside A-Z a-z 0-9 + / =), or it's valid Base64 that decodes to bytes which aren't valid UTF-8 text — for example, Base64 of an image or of a JWT's binary signature, neither of which was ever meant to display as text.

Does this tool support Unicode text, not just English?

Yes — your text is converted to UTF-8 bytes before encoding (and validated as UTF-8 on decode), so accented letters, Cyrillic, CJK characters and emoji all round-trip correctly, unlike the browser's raw btoa()/atob() functions, which throw on anything outside Latin-1.

Is my text sent to a server?

No — the entire conversion runs in your browser using built-in JavaScript functions. This page makes no network request to perform it.

What's the difference between standard Base64 and Base64URL?

Base64URL (RFC 4648 §5) replaces the "+" and "/" characters with "-" and "_" and drops padding, because "+" and "/" have special meaning inside a URL. JWTs use Base64URL, not standard Base64 — use the JWT Decoder tool for those instead of this page.