Free Base64 Encoder and Decoder
Turn text into Base64 or Base64url and back, and see exactly which character or length breaks a string.
What is a Base64 Encoder and Decoder?
A Base64 encoder turns text into a string of 64 safe characters, and a decoder turns that string back into the original text. Base64 exists so bytes can travel through systems built for plain text, such as email bodies, JSON fields and URLs.
This tool follows RFC 4648. It encodes your text as UTF-8 first, so accented letters and emoji round-trip exactly, and it reads both the standard alphabet and the URL-safe variant. When a string won’t decode, the error says why: a character outside the alphabet, the other variant’s characters, an impossible length, or bytes that aren’t text.
Key Features
Every Character Round-Trips
Text is encoded as UTF-8 before conversion, so “Café ☕” becomes Q2Fmw6kg4piV and decodes back to the same nine bytes. Nothing is dropped or replaced with a question mark.
Both Alphabets in One Place
Switch between standard Base64 and Base64url without reloading. URL-safe output uses minus and underscore and leaves out padding, the form JWTs and URL parameters expect.
Errors That Name the Problem
A failed decode tells you whether a character is outside the alphabet, belongs to the other variant, or leaves an impossible length. You fix the input instead of guessing.
Wrapped Input Still Decodes
Spaces and line breaks are skipped before decoding, so a certificate body or an email part wrapped at 76 characters reads as one string. You don’t have to join the lines first.
Your Text Stays on Your Device
Conversion runs in your browser tab, and the text is never sent to a server. That matters when the string is a password, a token or a customer record.
Perfect for everyone
- Backend developers reading API payloads
- QA engineers building test fixtures
- DevOps engineers editing Kubernetes secrets
- Security analysts inspecting tokens
How to Use the Base64 Encoder and Decoder
Pick a direction, paste, and the result updates as you type.
Choose Encode or Decode
Pick Encode to turn text into Base64, or Decode to read a Base64 string. Use URL-safe or From URL-safe when the string sits in a URL, a filename or a JWT, where plus and slash would break.
Paste Your Text or String
Type or paste into the source field. Line breaks inside a Base64 string are fine, because they are removed before decoding, and inputs up to 200,000 characters convert straight away.
Read the Result or the Reason
A valid input shows the converted text at once. An invalid one shows a red line naming the first problem, such as the character that doesn’t belong or the length that can’t be Base64.
Copy It Where It Goes
Copy the result into your header, config file or test, or download it as a text file. The In and Out counts below the field show how much the encoding grew or shrank.
Real Conversions From This Tool
Each row is an input typed into this tool and the exact result it returned, including the error lines. Try one, then reveal the answer to compare.
“Café ☕”
“user@example.com:hunter2”
“{"alg":"HS256","typ":"JWT"}”
“SGVsbG8sIFdvcmxkIQ==”
“VGhlIHF1aWNrIGJyb3du IGZveA==”
“eyJzdWIiOiIxMjM0NTY3ODkwIn0”
“PDw_Pz4-”
“Zm9v!”
“SGVsbG8sQ”
“iVBORw0KGgo=”
The Base64 Alphabet, Value by Value
Base64 splits bytes into six-bit groups, and each group picks one of 64 characters. These entries cover every range of the table and the rules around it.
A to Z Carry Values 0 to 25
Capital letters hold the first 26 values in order, so A is 0 and Z is 25. A six-bit group below 26 always becomes a capital letter.
“Which value does Q stand for?”
a to z Carry Values 26 to 51
Lowercase letters continue straight after Z, so a is 26 and z is 51. That is why decoded case matters: Q and q are different values.
“Which value does g stand for?”
Digits Carry Values 52 to 61
The ten digits come next, with 0 as 52 and 9 as 61. A digit in a Base64 string is never a number in the decoded data.
“Which value does 7 stand for?”
Plus and Slash Close the Standard Table
Standard Base64 uses + for 62 and / for 63. Both clash with URLs, where + can mean a space and / separates path segments.
“Which value does / stand for?”
Minus and Underscore Replace Them in Base64url
RFC 4648 section 5 swaps + for - and / for _, so a string survives a URL or a filename untouched. The two alphabets agree on every other character.
“What is - in standard Base64?”
The Equals Sign Pads the Last Group
Output always comes in groups of four characters, and = fills the gap when the input ends early. It carries no data of its own.
“What does TWE= decode to?”
Three Bytes Become Four Characters
Three bytes hold 24 bits, exactly four six-bit groups, so they encode with no padding. This 3-to-4 ratio is why Base64 output is about a third longer than its input.
“What does Man encode to?”
One Leftover Byte Takes Two Equals Signs
A single trailing byte fills two characters and needs == to complete the group. Two leftover bytes need one =.
“What does M encode to?”
Accented Letters Take More Than One Byte
UTF-8 stores é as the two bytes C3 A9, so it encodes to more characters than a plain e would. The same holds for emoji, which take four bytes.
“What does é encode to?”
Line Breaks Belong to the Transport
MIME email wraps Base64 at 76 characters per line, and PEM files at 64. Those breaks are not part of the data, so a decoder should skip them.
“Does a wrapped string decode the same as one line?”
Base64 Variants You Will Meet
The alphabet barely changes between standards, but the padding, line length and surrounding text do.
Standard Base64, RFC 4648 Section 4
The default alphabet with + and / and = padding, used in email, JSON payloads and most API fields. Pick Encode and Decode for it.
Base64url, RFC 4648 Section 5
Swaps + and / for - and _ so the string is safe in URLs and filenames. Use URL-safe and From URL-safe for it.
Unpadded Base64url in JWTs
RFC 7515 drops the trailing = from each JWT segment, which is why URL-safe output here has no padding. Decoding accepts the string with or without it.
MIME Base64 in Email, RFC 2045
Email attachments and encoded headers wrap Base64 at 76 characters per line. Paste the whole block, because line breaks are ignored when decoding.
Data URLs, RFC 2397
A data URL puts a media type and the word base64 before a comma, then the data. Decode only the part after the comma, since the prefix uses characters outside the alphabet.
HTTP Basic Authentication, RFC 7617
The Authorization header carries username:password in standard Base64 after the word Basic. Encoding is not protection, so only send it over HTTPS.
Common Base64 Mistakes
Most failed decodes come from one of these, and the error line usually points at which one.
Treating Base64 as Encryption
Anyone can decode Base64 in one step, so it hides nothing. If a value is secret, encrypt it before encoding, or don’t put it in a URL or log at all.
Leaving the Data URL Prefix On
Pasting data:image/png;base64, along with the data fails at the colon. Cut everything up to and including the comma before decoding.
Mixing the Two Alphabets
A string with - or _ is Base64url, and one with + or / is standard. The error names the character, so switch to the matching decode mode.
Losing a Character When Copying
A string cut off by one character often leaves a length that can’t be Base64. Recopy the full value, including any = at the end.
Forgetting the Size Increase
Encoded output is about 33% larger than the input, because three bytes become four characters. Budget for that in database columns and header limits.
Encoding Twice
A string that decodes to more Base64 was encoded twice by mistake. Decode it again and check the system that produced it.
Spot Encoded JSON by Its First Letters
A JSON object that opens with a quoted key, like every JWT header, almost always encodes to text beginning with eyJ. Seeing eyJ in a token or URL tells you to decode it as Base64url.
What People Use It For
Base64 shows up wherever bytes have to pass through a text-only channel.
Reading a JWT by Hand
Split the token at its dots and decode the first two parts with From URL-safe to see the header and claims. You can check the expiry and audience without a library.
Building a Basic Auth Header
Encode username:password and put the result after Basic in the Authorization header. Decoding an existing header shows which account a request uses.
Editing Kubernetes Secrets
The data fields of a Kubernetes Secret hold standard Base64. Decode a value to check it, edit it, then encode it again before applying the manifest.
Inspecting an Email Part
Paste a base64 MIME part from a raw message to read its text. Wrapped lines are fine, because they are joined before decoding.
Writing Test Fixtures
Encode a known string to get a stable fixture for a unit test. The same input always gives the same output, so assertions stay exact.
Reading a Value From a Log Line
Services often log payloads in Base64 to keep them on one line. Decode the value here to read the original text.
Checking an OAuth State Parameter
Many apps pack a small JSON object into the state parameter with Base64url. Decoding it shows what the app will read when the user returns.