Base64 Encoder / Decoder

Base64 encoding is a binary-to-text scheme that converts binary data into 64 printable ASCII characters. Raw bytes , images, files, encryption keys, anything , become a text string made up of A–Z, a–z, 0–9, plus "+" and "/". You'll also see this called base 64 encoding. The tool itself gets referred to as a base 64 encoder or base 64 decoder just as often.

Base64 decode reverses the process, turning that text string back into the exact original bytes. Data encoded this way remains intact through transport , the guarantee that made Base64 the standard for email attachments and HTTP payloads. This reversibility is also exactly why Base64 is not encryption, a distinction covered in detail later in this guide.

Base64 works by grouping input data into 3-byte (24-bit) chunks, then re-slicing each chunk into four 6-bit groups. Each 6-bit group holds a value from 0 to 63, which maps directly to one of the 64 characters in the Base64 alphabet. When the final chunk has fewer than 3 bytes, "=" padding fills the gap. This keeps the output length a multiple of 4.

Here's a real walkthrough: encoding the word "Cat" in ASCII. The 24 bits get re-packed into four 6-bit values, then mapped to Base64 characters. The table below shows the full conversion, byte by byte, so you can see exactly how the math works.

Result:Cat→Q2F0

Every 3 bytes of input become exactly 4 Base64 characters. That's why Base64 output is always about 33% larger than the original data. This process is formally defined in RFC 4648, the internet standard covering both the Base64 and Base64URL alphabets. That overhead is the trade-off for guaranteed compatibility , MIME limits Base64 lines to 76 characters wide for email systems.

This Base64 encoder and decoder is built for speed , there's no account to create and no software to install. Four tabs cover every use case: Text, File, Image, and Base64 Validator to check a string before decoding. Everything processes locally in your browser, which means your data never touches a server.

Once you click Encode or Decode, the output box updates instantly with your result. Encoded text always reads as A–Z, a–z, 0–9, plus "+", "/", and "=" padding. If you see other characters, the input wasn't valid Base64 , use the Validator tab to confirm before decoding. Decoding back to readable text , a process called base64 to text conversion , works the same way: paste, click Decode, and copy.

Generic single-word examples don't show how base64 encode and base64 decode behave with real-world input. The table below walks through five common scenarios, from a short string to a URL-safe token segment. You'll know exactly what to expect from your own data. Every example below uses the standard Base64 alphabet with UTF-8 input, which is this tool's default.

Notice the URL-safe example uses Base64URL encoding with no "=" padding, while the JSON example uses standard Base64 with padding intact. Base64URL replaces "+" with "-" and "/" with "_" for exactly this reason. It travels safely inside URLs, cookies, and HTTP headers, where "+" and "/" can cause problems. That's why auth tokens, session identifiers, and other URL-embedded data almost always use the URL-safe variant.

Images are a common Base64 use case. Developers base64 encode them to embed directly into CSS, HTML, or JSON without a separate file request. Upload an image to get a Base64 data URI, or paste a Base64 string to download the decoded result. Supported formats are PNG, JPEG, GIF, SVG, and WebP.

Converting an image to Base64 produces a data URI like data:image/png;base64,iVBORw0KGgo... that drops straight into a src attribute or a CSS background-image property. Converting Base64 back to an image works in reverse. Paste the encoded string, and the tool decodes it, displays a live preview, and gives you a one-click download. This round trip is especially useful when an API response returns image data as a Base64 string instead of a binary file.

Most developers don't just need a one-off conversion , they need to replicate the same Base64 logic inside their own application. The snippets below cover the three most common languages for encoding and decoding text. Each example uses "Hello, world!", with output that matches what this tool produces.

// Encode
const encoded = btoa("Hello, world!");
console.log(encoded); // SGVsbG8sIHdvcmxkIQ==

// Decode
const decoded = atob(encoded);
console.log(decoded); // Hello, world!

import base64

encoded = base64.b64encode(b"Hello, world!")
print(encoded.decode())  # SGVsbG8sIHdvcmxkIQ==

decoded = base64.b64decode(encoded)
print(decoded.decode())  # Hello, world!

package main

import (
    "encoding/base64"
    "fmt"
)

func main() {
    encoded := base64.StdEncoding.EncodeToString([]byte("Hello, world!"))
    fmt.Println(encoded) // SGVsbG8sIHdvcmxkIQ==

    decoded, _ := base64.StdEncoding.DecodeString(encoded)
    fmt.Println(string(decoded)) // Hello, world!
}

Javascript base64 encode and javascript base64 decode both run through btoa() and atob(), which work natively in every browser. They only handle Latin1 text cleanly, though , for full UTF-8 support like emoji or accented characters, encode with TextEncoder first. In Node.js, use Buffer.from(str).toString('base64') to encode and Buffer.from(b64, 'base64').toString() to decode. Python and Go use their standard libraries and handle UTF-8 natively out of the box.

No , Base64 is encoding, not symmetric encryption, and that distinction matters more than most developers realize. Encoding is fully reversible by design. Anyone with the Base64 string can decode it back to the original data in seconds, with no key or password required. If you need to protect sensitive data, Base64 alone provides zero confidentiality.

This matters most in authentication contexts, where access tokens and session identifiers are often Base64-encoded but not encrypted. Treat any Base64 string the same way you'd treat plain text. Don't put secrets, passwords, or private keys into it unless they're also encrypted first. For genuine confidentiality, our AES Encryption / Decryption handles AES encryption and decryption directly in your browser.

On the privacy side, this tool runs entirely client-side in your browser. Text, file, and image conversions never get uploaded to a server. Sensitive payloads , API tokens, internal file contents, credentials you're debugging , stay on your machine the entire time. If you're verifying API signatures or webhook payloads, our HMAC Generator generates HMAC-SHA256 output that you can inspect here.

Base64 errors are almost always one of three issues, and each has a quick fix. Recognizing the pattern saves you from re-checking your entire input when the problem is something simple.

If your string came from a URL, cookie, or auth token, it's almost certainly Base64URL rather than standard Base64. That's the "wrong character set" row above. This tool auto-detects both variants, so pasting a token segment or a URL-safe string decodes correctly without manual conversion. If you're unsure whether a string is valid Base64 at all, the Base64 Validator tab tells you instantly.

Base64 isn't the only binary-to-text scheme, and picking the right one depends on where the output is headed. The table below compares Base64 against the two encodings developers most often confuse it with.

Hex is more readable for short hashes but doubles the output size, making it impractical for large files. Standard URL encoding is built for query strings, not binary data. That's why Base64 , Base64URL specifically , became the default for anything binary that needs to travel through a URL. For percent-encoding query strings, our URL Encoder / Decoder is the better fit; for SHA-256 or MD5 hashes, our Hash Generator covers every major algorithm.