Base64 Encode / Decode
Encode text to Base64 or decode Base64 to text, URL-safe included
About this tool
Base64 turns arbitrary bytes into a 64-character alphabet that survives being pasted into JSON, URLs, HTTP headers and email. This tool converts in both directions: type or paste text to encode it, or paste an encoded blob to get the original back. UTF-8 is handled correctly both ways, so emoji and non-Latin scripts round-trip without mangling.
The decoder is forgiving on purpose: it accepts the URL-safe alphabet (- and _ in place of + and /), strips whitespace and line breaks, and restores missing padding before decoding — the three things that most often make stricter decoders reject perfectly recoverable input. If the decoded bytes are not valid UTF-8 text it says so instead of printing garbage, which usually means the payload was binary data such as an image.
Everything happens in the page. Decoding a token or credential here does not transmit it anywhere.
Frequently asked questions
- Why does my Base64 string end with = signs?
- Base64 encodes 3 bytes into 4 characters, so when the input length isn't a multiple of 3 the output is padded with = to keep groups aligned. Padding carries no data; this decoder restores it automatically if it was stripped.
- What is the difference between standard and URL-safe Base64?
- Standard Base64 uses + and /, which have special meaning in URLs and must themselves be escaped. The URL-safe variant (RFC 4648 §5) swaps them for - and _ and usually drops padding. JWTs, for example, use the URL-safe form. The encoder here offers both; the decoder accepts either automatically.
- Is Base64 encryption?
- No. Base64 is a reversible encoding with no key — anyone can decode it. It protects data from transport corruption, not from being read. If you need confidentiality, encrypt first and encode the ciphertext.
- Why does decoding say the result is not valid UTF-8?
- The string decoded successfully, but the resulting bytes are not text — often a PNG, a PDF, or compressed/encrypted data. Decoding such content to a text box would show mojibake, so the tool flags it instead.