How to Encode and Decode Base64 Online
To encode text to Base64: paste or type your plain text into the Input field on the left, make sure the Encode mode is selected (the blue pill button at the top), then click the Encode button. The Base64-encoded string appears instantly in the Output field on the right. Click Copy to send the result to your clipboard — ready to paste into an API request, email header, data URI, or configuration file.
To decode Base64 back to plain text: click the Decode button to switch modes, paste your Base64 string into the Input field, then click Decode. The original text appears in the Output field. If the input is not valid Base64 — for example it contains invalid characters or incorrect padding — the tool will display an error message below the output. Click Clear at any time to reset both fields and start over.
Base64 encoding increases the output size by approximately 33% (every 3 input bytes become 4 output characters), so a 1 KB file becomes roughly 1.33 KB when encoded. This overhead is the trade-off for text-safe transport. The tool handles the full UTF-8 character set — including emoji, Chinese/Japanese/Korean characters, and accented European letters — by first converting the text to a UTF-8 byte sequence and then encoding those bytes. If you need to encode binary files rather than text, consider a command-line tool such as the base64 utility on macOS and Linux. For URL-safe encoding of query parameters, see the related URL Encoder tool.
Why Use This Free Base64 Encoder & Decoder?
- 100% browser-based — your text and data never leave your device or touch any server
- Handles full UTF-8 and Unicode input correctly, including emoji, CJK characters, and accented letters
- Encode and decode in the same tool — no need to switch between separate sites
- Instant results with no page reload — output appears as soon as you click the button
- Validates input on decode — clearly reports invalid characters and padding errors
- Completely free with no rate limits, no account, and no installation required
- Safe for sensitive payloads — API tokens, credentials, and private strings stay local
Frequently Asked Questions
What is Base64 encoding and what is it used for?
Base64 is a binary-to-text encoding scheme defined in RFC 4648 that represents binary data using only 64 printable ASCII characters (A–Z, a–z, 0–9, +, /). It is widely used to safely embed binary content — such as images, files, or binary API payloads — inside text-only formats like JSON, XML, HTML, CSS data URIs, and email (MIME). Because Base64 uses only printable characters, it avoids issues with special characters, null bytes, or control characters that would break text-based protocols. The encoding was originally designed for MIME email attachments and has since become a standard mechanism in virtually every web API.
Source: RFC 4648 — The Base16, Base32, and Base64 Data Encodings
Does Base64 encoding encrypt my data?
No. Base64 is an encoding scheme, not an encryption algorithm. It simply converts binary data into a text-safe format using a publicly known alphabet — anyone who has your Base64 string can decode it back to the original content instantly without a key or password. Never use Base64 as a security measure. If you need to protect sensitive data, use a proper authenticated encryption algorithm such as AES-256-GCM before encoding the ciphertext with Base64 for transport. The OWASP Foundation explicitly warns against treating encoding as encryption in its application security guidelines.
Why does my Base64 output sometimes end with '=' or '=='?
Base64 encodes every 3 bytes of input into 4 characters. When the input length is not a multiple of 3, the encoder adds padding characters ('=') at the end to make the total output length a multiple of 4. One '=' means the last group had 2 input bytes; two '==' means it had only 1 input byte. If the input is exactly divisible by 3, no padding is added. The padding is required by the Base64 specification (RFC 4648 section 4) and is automatically handled by decoders — you should always include it when passing Base64 strings to standard decoders.
Is it safe to paste sensitive data into this tool?
Yes. This encoder runs entirely inside your browser using JavaScript's native btoa() and atob() APIs — no network request is made at any point. Your input is never transmitted to any server, never stored, and never logged. You can safely encode or decode API keys, authentication tokens, private configuration values, or any other sensitive strings. Closing or refreshing the page clears all input and output immediately. You can verify this by opening your browser's DevTools Network tab while using the tool — no outbound requests will appear.
What is the difference between standard Base64 and Base64url?
Standard Base64 uses '+' and '/' as the 62nd and 63rd characters, which are not safe to use directly in URLs or filenames because browsers and servers interpret them as special characters. Base64url (defined in RFC 4648 section 5) is a URL-safe variant that replaces '+' with '-' and '/' with '_', and often omits the trailing '=' padding. Base64url is used in JSON Web Tokens (JWT), OAuth authorization codes, and file names. If you need to include a Base64 string in a URL query parameter, either switch to Base64url or percent-encode the standard Base64 output using a URL encoder.
Source: RFC 4648 § 5 — Base 64 Encoding with URL and Filename Safe Alphabet
How much larger does Base64 make my data?
Base64 encoding increases the size of the data by approximately 33%. Every group of 3 input bytes is represented as 4 output characters, so the formula is: output size = ceil(input bytes / 3) * 4. A 1 KB input produces roughly 1.33 KB of Base64 text; a 1 MB file becomes about 1.33 MB encoded. This overhead is the cost of representing arbitrary binary data using only 64 printable ASCII characters. For bandwidth-sensitive applications, consider compressing the data with gzip or Brotli before Base64-encoding it — the compression typically more than offsets the 33% encoding overhead.
By UtilDaily · Updated \u2014 free, privacy-first browser tools. No sign-up, no data collection.