Base64 Encoder & Decoder — Free Online Tool

Convert text to a standard Base64 string, or decode a valid Base64 string back to text. This tool is ideal for small snippets when working with APIs, JSON, config files, HTML, and logs. Base64 is designed to represent binary data using text characters — it is not a security mechanism.

What Base64 Does

Computers store text and files as sequences of bytes. Not every transmission channel handles arbitrary bytes gracefully, so Base64 converts them into a restricted set of printable ASCII characters.

The standard alphabet uses:

• Latin letters A–Z and a–z;
• digits 0–9;
• the characters + and /;
• the = padding character at the end when needed.

Example:

Original text: Example
Base64: RXhhbXBsZQ==

Decoding this string returns the original byte sequence, and the tool then attempts to display it as text.

Base64 Is Not Encryption

An encoded string can be decoded by any person or program. Base64 has no secret key, no password, and no access-control mechanism.

Therefore, Base64 must not be used as protection for:

• passwords;
• API keys and tokens;
• personal data;
• private documents;
• payment information;
• configuration secrets.

Encoding changes how data is represented but does not make it confidential. The term “decrypt Base64” is technically inaccurate — the correct term is “decode.”

Base64 Does Not Compress Data

Every three original bytes typically become four Base64 characters. The exact size of the result, excluding line breaks, can be estimated as:

4 × ceil(number of original bytes / 3)

For sufficiently large data, the volume increases by about one third. For short strings, the relative increase can be larger due to rounding and padding = characters.

Base64 is used not to save space, but when data must be safely transmitted through a text-based format. If size matters, first apply appropriate compression, then use Base64 only if the transport layer actually requires it.

Why Text Encoding Matters

Base64 encodes bytes, not abstract letters. Before encoding, text must be converted to bytes — most commonly in UTF-8.

The same string in UTF-8, UTF-16, or another encoding will produce different Base64 results. When decoding, the bytes must also be interpreted in the correct encoding. If you see garbled characters instead of readable text, the likely cause is an encoding mismatch, not a Base64 algorithm error.

How Base64url Differs from Standard Base64

In URLs, cookies, and certain tokens, the characters +, /, and = can be inconvenient. For this reason, RFC 4648 defines a URL-safe variant — Base64url:

Standard Base64	Base64url
+	-
/	_
padding = usually preserved	padding often omitted when the length is known

These are different alphabet variants. A Base64url string cannot always be fed directly to a standard Base64 decoder without preparation. When necessary, you must replace characters and restore missing padding to a multiple of four.

JWT segments are typically represented using Base64url, not standard Base64. Decoding them lets you read the header and payload contents, but it does not verify the token’s authenticity — that requires checking the cryptographic signature.

Where Base64 Is Actually Used

Text-Based APIs and Data Formats

Some interfaces require embedding binary data or special strings inside JSON, XML, or other text-based messages. Base64 allows you to transmit bytes without conflicts with transport control characters.

MIME and Email

Base64 may be used to represent attachments and content in MIME messages. The format of a specific email also includes headers and line-breaking rules, so a Base64 string alone is not sufficient to form a complete email.

Data URLs

A small resource can be embedded directly into HTML or CSS:

data:image/png;base64,iVBORw0KGgo...

The MIME type is specified before the Base64 data. Embedding increases the text size and prevents the resource from being cached separately, so it is not suitable for every file.

HTTP Basic Authentication

In the Basic Auth header, the username and password are concatenated and encoded with Base64. This does not secure the credentials by itself — transmission security depends on HTTPS.

Logs and Debugging

Decoding can help you understand the contents of a small fragment from an API response, log entry, or configuration file. However, you should never paste production secrets or personal data into a third-party online tool.

Why a String Might Not Decode

The most common causes are:

• the string has been truncated;
• Base64url characters - and _ are used, but the decoder expects + and /;
• required padding = characters are missing;
• the input contains spaces, line breaks, or extraneous characters;
• a Data URL prefix was copied along with the data;
• the original bytes do not represent text;
• the wrong text encoding is applied after decoding.

Decoder behavior varies: some ignore whitespace or restore padding, while others reject the string outright. For integration, follow the requirements of your library and protocol.

Text vs. Files — Different Use Cases

This tool is designed for text. Although any file can technically be represented in Base64, for large images, archives, or documents it is more practical to use a dedicated file encoder or a software library. Attempting to open arbitrary binary bytes as text may produce unreadable output or result in data loss when copying.

Security When Using an Online Converter

Do not paste real passwords, private keys, access tokens, authorization cookies, personal data, or confidential documents. Even when processing is claimed to happen in the browser, the secure practice is to use local tools for sensitive data and to substitute test values for real ones.

Frequently Asked Questions

Can I recover the original text from Base64?

Yes, provided the string is not corrupted, the correct Base64 variant was used, and the original bytes actually represent text in a known encoding.

Why is there one or two = characters at the end?

This is padding that aligns the final group to the required length. It is not part of the original text.

Why did two programs produce different strings for the same text?

They may have used different text encodings, standard Base64 vs Base64url, included a byte-order mark (BOM), or handled the trailing newline differently.

Can I store a password in Base64?

No. Base64 is easily reversible and is not designed for secure password storage. For server-side password storage, use dedicated password hashing algorithms with salt and appropriate cost parameters.

Does decoding a JWT mean the token is authentic?

No. Decoding only reveals the data. Authenticity and integrity are established through a separate signature verification according to the system’s rules.

Related tools: Password Generator; Text Processor; Diffchecker.

Official standard:

• RFC 4648 — Base-N Encodings: https://www.rfc-editor.org/rfc/rfc4648