Base64 encoder and decoder.

Base64, defined in RFC 4648, represents any bytes using 64 characters that survive text-only systems: A-Z, a-z, 0-9, + and /. It takes the input three bytes (24 bits) at a time and splits them into four 6-bit groups, each of which picks one character. "Man" becomes TWFu.

When the input length is not a multiple of three, the last group is padded with = so the output length stays a multiple of four: one leftover byte gives two characters and ==, two leftover bytes give three characters and =. The output is always about a third larger than the input, exactly 4 characters for every 3 bytes, rounded up.

Base64 exists so binary data can travel through channels built for text: JSON and XML payloads, email attachments (MIME), HTML and CSS data URLs, HTTP Basic authentication and environment variables.

The standard alphabet uses + and /, which have special meanings in URLs and file paths. Base64URL (RFC 4648, section 5) replaces them with - and _ and usually drops the = padding, so the value can sit in a query string, a filename or a cookie without further escaping.

Every part of a JWT is Base64URL, which is why the JWT decoder can read them. Tick URL-safe when encoding to get Base64URL. When decoding, this tool accepts either alphabet and restores missing padding automatically. If you must put standard Base64 in a URL, percent-encode it with the URL encoder, because an unescaped + is often read as a space.

Base64 encodes bytes, not characters, so text must first be turned into bytes. The browser's built-in btoa assumes each character is a single Latin-1 byte. It throws an InvalidCharacterError for anything above U+00FF, such as emoji, Chinese, Arabic or Devanagari, and it encodes é as one byte (6Q==) where a UTF-8 server expects two (w6k=).

This tool encodes text as UTF-8 first, the same as TextEncoder, Node.js Buffer, Python's str.encode() and virtually every API, so any language round-trips exactly. When decoding, it insists on valid UTF-8 and tells you if the bytes are something else.

Switch to File and drop an image, PDF, font or any other file up to 10 MB. The browser reads it locally with FileReader and produces a data URL in the RFC 2397 format, data:<media type>;base64,<data>. Copy the whole data URL for an img src or a CSS url(), or copy only the raw Base64 for a JSON field or an API that wants the bare string. Images get a small preview so you can check you picked the right file.

Inlining saves an HTTP request but makes the file about 33% larger, cannot be cached separately, and makes the HTML or CSS file that contains it heavier, which delays everything else in that file. It suits tiny icons and one-off images. For anything bigger, a normal image file served from a CDN is usually faster; our guide to Core Web Vitals explains why it matters for LCP.

The decoder is for text. If you paste the Base64 of an image or PDF, it decodes the bytes and tells you they are not UTF-8 text rather than showing garbage.

"Invalid character" errors usually mean the value contains something outside the alphabet: quotes copied from code, a data: prefix in a decoder that does not expect it, or URL-escaped sequences such as %2B. This tool strips a data: URL prefix and all whitespace, including the line breaks MIME inserts every 76 characters, before decoding.

A value whose length leaves a remainder of 1 when divided by 4 is truncated and cannot be decoded. Text that decodes to more Base64 was encoded twice; decode again. Text that turns into odd symbols such as é was decoded as Latin-1 instead of UTF-8 somewhere along the way.

In JavaScript, turn text into UTF-8 bytes first: new TextEncoder().encode(text) gives the bytes, and btoa on a binary string of those bytes gives Base64, which is what this tool does. Recent browsers and runtimes also provide Uint8Array.prototype.toBase64() and Uint8Array.fromBase64(), which convert bytes directly and can use the Base64URL alphabet; check support if you target older browsers. In Node.js, Buffer.from(text).toString("base64") and Buffer.from(value, "base64") are the standard approach, and "base64url" works as an encoding name too.

Python's base64 module has b64encode and b64decode, plus urlsafe_b64encode and urlsafe_b64decode for the URL-safe alphabet. They take and return bytes, so call .encode() and .decode() at the edges. On the command line, base64 encodes a file and base64 --decode reverses it. Whatever the language, decode with the same alphabet you encoded with, and add back missing padding if the value came from a URL or a JWT.

Anyone can decode Base64 instantly; it hides nothing. HTTP Basic authentication sends user:password in Base64, which is why it is only safe over HTTPS. Kubernetes Secrets are stored as Base64 too, so treat the manifest as sensitive.

For confidentiality you need encryption. To check integrity or fingerprint a file, use a hash such as SHA-256 from the hash generator. Like every tool on this page, the encoder runs in your browser, so the text and files you convert never leave your device.