Base64 Encoder / Decoder

What Is Base64? Base64 is a binary-to-text encoding scheme that converts binary data (raw bytes) into a sequence of 64 printable ASCII characters: A–Z, a–z, 0–9, plus (+), and slash (/), with equals (=) used for padding. The name comes from the 64 characters in the output alphabet. Every 3 bytes of input are converted into 4 Base64 characters, increasing the size by approximately 33%.

Why Base64 Exists Many communication protocols and file formats were originally designed to handle only 7-bit ASCII text, not arbitrary binary data. Email (SMTP), HTTP headers, XML, JSON, and HTML attributes all have restrictions on what characters they can contain. Base64 solves this by encoding any binary data as safe, printable text that travels through these systems without corruption.

Common Real-World Uses

HTTP Basic Authentication sends the username and password in the Authorization header as “Authorization: Basic dXNlcjpwYXNz”, where “dXNlcjpwYXNz” is Base64 for “user:pass”. Encode that string above and you will get exactly those twelve characters back, which is the whole point: anyone watching the connection can do the same.

Data URLs embed a file directly in HTML or CSS. An image tag can carry a Base64-encoded PNG in its src attribute and save a network request, at the cost of a third more bytes and no browser caching.

JWT (JSON Web Token), the format behind most modern web logins, encodes its header and payload as URL-safe Base64. Paste the middle segment of one into the decoder here and you can read the claims, which surprises people who assume a token is opaque.

SSH public keys and SSL/TLS certificates ship as Base64 text too, wrapped in the familiar “—–BEGIN CERTIFICATE—–” markers.

URL-Safe Base64 Standard Base64 uses + and / which have special meaning in URLs. URL-safe Base64 (used in JWTs and many web APIs) replaces + with - (hyphen) and / with _ (underscore), making the encoded string safe to use in URL parameters without percent-encoding.

Base64 Is Not Encryption

Base64 is an encoding, not encryption. Anyone can decode it instantly, with no key and no effort, so it provides zero confidentiality. Seeing Base64 in a URL or a header does not mean the data is protected. For actual security you want AES or TLS.

UTF-8 and Multi-byte Characters

Plain ASCII encodes one byte per character. Accented letters, non-Latin scripts and emoji do not: they become UTF-8 (Unicode Transformation Format, 8-bit) byte sequences first, and only then get Base64-encoded. The size numbers on this page count real bytes rather than characters for exactly that reason. “café” is four characters but five bytes, because é takes two. Naive implementations that call btoa() directly on a string throw on anything above U+00FF, which is the single most common Base64 bug in JavaScript.