Base64 Encoder / Decoder

What Base64 Changes, and What It Does Not

Base64 represents bytes with a restricted alphabet of letters, digits, +, /, and optional = padding. It is useful when a text-only channel must carry byte-oriented data, but it is not encryption, compression, or hashing. Anyone who has the encoded string can decode it, and the representation is usually about one-third larger than the original bytes.

This tool provides a direct text-to-Base64 and Base64-to-text workflow using the browser functions btoa() and atob(). That implementation detail defines its most important boundary: it works reliably with strings whose code units fit the Latin-1 byte range. Plain ASCII is ideal. Arbitrary Unicode text and binary files need a UTF-8 or file-aware conversion step that this interface does not provide.

A Quick Round Trip

Choose Encode, enter:

Hello, developer!

The output is:

SGVsbG8sIGRldmVsb3BlciE=

Press the circular swap control. The output moves into the input, the mode changes to Decode, and the original text reappears below. This round trip is a useful integrity check for compatible text. Copy writes the current non-empty result to the clipboard, while Clear resets the input and output.

Conversion runs whenever the input or mode changes. There is no submit button and no option panel for character sets, URL-safe alphabets, line wrapping, or file input.

How the Encoding Is Structured

Base64 processes three input bytes, or 24 bits, at a time. It divides those bits into four groups of six and maps each group to one of 64 printable characters. When the final block contains fewer than three bytes, = padding fills the unused output positions.

That is why output lengths commonly occur in multiples of four. One input byte produces two meaningful Base64 characters plus ==; two bytes produce three characters plus =; three bytes produce four characters without padding. Padding conveys block length rather than secret metadata.

For ASCII text, each character corresponds directly to one byte, so the browser functions produce familiar results. Base64 does not preserve a concept of “text” internally; it preserves bytes. Correct decoding therefore depends on agreeing about which character encoding produced those bytes.

Inspecting Basic Authentication Material

HTTP Basic authentication represents username:password as standard Base64. To inspect a development credential string, encode an exact value such as:

demo:correct-horse

The result can appear after the Basic authentication scheme in an HTTP header. This encoding provides no confidentiality. Transport it only over TLS, avoid production secrets in screenshots or logs, and prefer stronger authentication methods when available.

When decoding a captured Basic value, remove the literal Basic prefix first. The decoder expects only Base64 input. After decoding, split the result according to the relevant protocol rules rather than assuming every colon has the same meaning.

JSON and Configuration Values

Small ASCII configuration fragments are another common use. Encoding:

{"mode":"test","retries":3}

can help place the bytes in a text field that expects Base64. Before doing this, confirm that the consumer wants Base64 of the exact JSON bytes, not Base64URL, hexadecimal, or a compressed payload. Whitespace in JSON changes the encoded string even when parsed JSON meaning remains the same.

Kubernetes Secrets are a frequently misunderstood example: their manifest values are Base64-encoded, not encrypted by Base64. Cluster access controls and encryption-at-rest settings provide the actual security boundary. This utility can inspect compatible ASCII values, but secret-handling policy still applies.

Unicode: The Important Browser Limitation

Entering café may work because é lies within the byte-sized range accepted by btoa(), but the resulting byte interpretation may not match a system expecting UTF-8. Entering characters such as ✓, many non-Latin scripts, or emoji generally produces Encoding error because their JavaScript code units exceed 255.

For interoperable Unicode, text should first be encoded into UTF-8 bytes with TextEncoder, then those bytes should be Base64-encoded. Decoding reverses the process with TextDecoder. This page does not perform that byte conversion, so do not use it to assert UTF-8 Base64 results for arbitrary text.

This distinction explains why two tools can encode the same visible non-ASCII text differently. They may be using Latin-1, UTF-8, UTF-16, or another byte encoding before Base64. Always identify the expected charset from the receiving specification.

Standard Base64 Versus Base64URL

Standard Base64 uses + and /, which have special meanings in URLs and filenames. Base64URL replaces them with - and _ and commonly omits trailing =. JSON Web Tokens use Base64URL for header and payload segments.

This tool calls standard btoa() and atob() without translating alphabets. It is therefore not a dedicated Base64URL or JWT decoder. A URL-safe value containing - or _ may be rejected as Invalid Base64 string, and an unpadded value may behave differently across runtimes. For JWTs, use the JWT Decoder, which normalizes the URL-safe alphabet and padding before decoding JSON.

Do not solve alphabet mismatches by blindly replacing characters unless the protocol explicitly specifies Base64URL. The sender and receiver must agree on alphabet, padding, and input bytes.

Diagnosing Invalid Base64

Decode errors generally indicate characters, padding, or length that atob() cannot interpret. Work through these checks:

• Remove protocol labels or data-URL prefixes if the field expects only the payload.
• Confirm the alphabet is standard Base64 rather than Base64URL.
• Check that = appears only at the end and no more than the required padding is present.
• Look for truncation introduced by copying, a database column limit, or line handling.
• Verify that the source is Base64 at all; hexadecimal and opaque tokens can look similarly random.

Whitespace handling can differ by decoder and surrounding system. If copied MIME data includes line breaks, use a MIME-aware workflow or normalize it according to the source specification. This text area does not expose a “strict versus lenient” option.

A successful decode only proves that the character sequence was accepted. Many unrelated byte sequences are syntactically valid Base64. The decoded result may be binary and appear as control characters or unreadable text because atob() returns a binary string rather than detecting file type or charset.

Binary Files and Data URLs

Base64 is widely used in data URLs, email attachments, certificates, and serialized blobs, but this component accepts text pasted into a textarea. It does not upload files, render images, identify MIME types, or download decoded bytes. Pasting a large binary-derived string may produce a text result that cannot be represented meaningfully in the interface.

A data URL has metadata before the comma:

data:image/png;base64,iVBORw0KGgo...

Only the portion after the comma is the Base64 payload. Even then, use a file-aware decoder if the goal is to reconstruct a PNG. The displayed output is not a binary file writer.

For PEM certificates, headers such as -----BEGIN CERTIFICATE----- and line breaks frame a Base64-encoded DER payload. Certificate tooling should parse and validate that structure; removing the frame and decoding bytes is only one step.

Security and Data Handling

Base64 obscures data from casual reading but offers no secrecy. API keys, passwords, session material, and personal data remain sensitive before and after conversion. Avoid placing encoded secrets in public tickets or source control under the assumption that they are protected.

Malformed or untrusted decoded text should remain untrusted. If another application inserts it into HTML, a command, or a configuration file, that destination requires its own validation and escaping. Base64 validation does not establish content safety.

The component performs conversion in the browser and uses clipboard access only when requested. For very large values or regulated data, use approved local tooling with explicit file, memory, and audit controls.

When This Tool Is the Right Fit

Use it for short ASCII samples, standard Base64 fields, Basic-auth experiments, and quick reversible inspection. It is also convenient for checking whether padding or a copied character caused a small payload to fail.

Choose another workflow for Unicode requiring UTF-8, Base64URL tokens, binary files, MIME attachments, cryptographic key validation, streamed data, or large payloads. A command-line or programming-language library makes byte encoding and error policy explicit and avoids textarea limitations.

Base64 Encoder / Decoder FAQ

Why does encoding emoji show an error?

The browser’s btoa() expects byte-sized string code units. Emoji and many Unicode characters exceed that range. Encode the text to UTF-8 bytes first with a Unicode-aware tool.

Is Base64 safe for passwords or API keys?

No. It is immediately reversible. Protect secrets with access controls, encryption where appropriate, and secure transport.

Why does my JWT segment fail to decode?

JWTs use Base64URL, replacing + and / with - and _ and often dropping padding. Use the JWT Decoder or a Base64URL-aware library.

What does the trailing = mean?

It pads the final four-character block when the input byte count is not divisible by three. It is not part of the original data.

Can this convert an image to Base64?

Not directly. There is no file reader. Use a binary-safe file tool that can read bytes and optionally construct a MIME-qualified data URL.

Why is decoded output unreadable even though no error appears?

The Base64 may represent binary bytes or text in a different charset. Successful alphabet decoding cannot determine how those bytes should be interpreted.

Does Base64 reduce size?

No. It normally expands the data by roughly 33 percent before line wrapping or metadata. Compression, when useful, is a separate operation usually applied before encoding.