Base64 encode / decode
Runs entirely in your browser. Your files and data never leave your device.
About this tool
Base64 turns binary data into ASCII text using 64 characters: A through Z, a through z, 0 through 9, plus + and /. It doesn’t encrypt anything, so anyone can decode it. What it does well is make arbitrary bytes safe to embed in places that only accept text, such as JSON payloads, data URIs, HTTP basic-auth headers, and email attachments. The exact rules for the alphabet and padding come from RFC 4648.
Paste text to encode it to Base64, or paste a Base64 string to decode it back.
Is my data uploaded anywhere?
No. Everything runs locally in your browser using the same text encoding and decoding functions built into the JavaScript engine. Nothing you type is sent to a server, which makes it safe to use with credentials, tokens, and other sensitive values.
Why does decoding sometimes fail?
The decoder trims surrounding whitespace before decoding, since a Base64 string copied from a chat message or a config file often picks up a stray newline or space. Beyond that, it expects standard Base64: the usual alphabet and padding, not the URL-safe variant that swaps +// for -/_. If what you pasted uses that variant, or isn’t valid Base64 at all, decoding will fail rather than produce a mangled result.
Encoding, meanwhile, first converts your text to raw bytes using UTF-8 (the standard way to represent Unicode as bytes), then Base64-encodes those bytes. That two-step process is why emoji, accented letters, and non-Latin scripts round-trip correctly instead of breaking on the way through.
What’s the difference between Base64 and encryption?
None of the input is hidden. Base64 is an encoding, not a cipher: it’s a reversible, publicly known way to represent bytes as text, and anyone with a Base64 decoder, including this same page, can read it straight back. If you need to keep something secret, encrypt it first (this site’s AES encrypt / decrypt tool works entirely client-side too) and Base64-encode the result only if you need it in plain text form.
People reach for this to read the credentials inside an Authorization: Basic header, inspect a data: URI, check what a Base64 blob in a config file or JWT segment actually contains, or encode a string for an API that requires Base64 input. For more on the encoding itself, see MDN’s Base64 glossary entry.