Base64 Encode and Decode

Type or paste text in the left box and the Base64 appears on the right as you type. Switch Mode to Decode, paste an encoded string, and you get the original text back or, if it holds a file, a preview and a download button. Press Encode a file to turn any file into text instead.

Every common variant is covered: four text encodings, the URL-safe alphabet, padding on or off, line breaks for email and PEM files, data: URIs and one result per line. When decoding you do not have to clean anything first. URL-safe characters, missing padding, spaces, line breaks and a data: prefix are all accepted.

All of it runs in your browser. The text and files you work with are never uploaded, so the page is fine for tokens, config values and private documents.

Base64 is a way to write any bytes with only 64 safe characters: A to Z, a to z, 0 to 9, plus + and /. It exists because many older systems, email above all, were built for plain text and could damage raw binary data on the way. Written in those 64 characters, a picture or a PDF can travel anywhere text can.

The rule is simple. The input is cut into groups of 3 bytes, which is 24 bits. Those 24 bits are split into four pieces of 6 bits, and each piece, a number from 0 to 63, picks one character from the alphabet. So every 3 bytes become 4 characters.

When the input length is not a multiple of 3, the last group is short. One leftover byte becomes 2 characters plus ==, and two leftover bytes become 3 characters plus =. Those equals signs are the padding, and they only ever appear at the end.

Because 3 bytes turn into 4 characters, the encoded result is about 33% bigger than the original, a little more if you add line breaks. The tool shows both sizes above the boxes, and in Encode mode the increase too, for example +33%.

This is an encoding, not encryption. There is no key and no secret: anyone who sees the text can decode it in a second, with this page or with one command. It hides nothing.

That matters because encoded values often look secret. HTTP Basic authentication headers, Kubernetes secrets and many config files store passwords this way, and the JWT Decoder shows that a JSON Web Token is mostly encoded JSON that anyone can read. Treat an encoded password exactly like the plain password.

If you need to keep something private, encrypt it, for example with Protect PDF for a document, and use a long random secret from the Password Generator. Encoding is also not compression: the output is always larger than the input, so compress first and encode afterwards if size matters.

To base64 encode online, keep Mode on Encode and type. The question that matters most is which bytes your text turns into, because the encoding works on bytes, not on letters. The Text encoding menu decides that.

UTF-8 is the default and almost always the right choice. It is what the web, JSON, Linux and most APIs use. English letters take one byte each; accented letters, other scripts and emoji take two to four bytes, so é becomes two bytes and 😀 becomes four.

ISO-8859-1 (Latin-1) gives one byte per character for Western European text and matches what older systems, and the browser's own btoa function, expect. Characters outside it are written as a question mark. ASCII allows only characters 0 to 127; type anything else and the tool tells you to choose UTF-8 rather than guessing. UTF-16 LE uses two bytes per character, little-endian, which is what Windows PowerShell expects for its -EncodedCommand option.

The same word can therefore give different results. café is Y2Fmw6k= in UTF-8 but Y2Fm6Q== in Latin-1. If your result does not match another system, try the other encodings before anything else.

When you decode, the same menu tells the tool how to read the bytes back into text. If the result shows odd pairs such as é where é should be, the bytes were UTF-8 read as Latin-1, or the other way round.

To base64 decode online, switch Mode to Decode and paste. You do not have to tidy the input. Spaces, tabs and line breaks are ignored, the URL-safe characters - and _ are understood, missing = padding is added back, and a data: prefix such as data:image/png;base64, is removed and its type remembered.

A small note under the result tells you what was fixed, for example URL-safe alphabet, missing padding added, or data URI (image/png). Characters that cannot be part of the encoding at all, such as quotes or commas copied by accident, are skipped and counted in the note, so you know the input was not clean.

The one thing that cannot be repaired is a wrong length. Without its padding, valid input always has a number of characters that leaves a remainder of 0, 2 or 3 when divided by 4. A remainder of 1 means a character is missing or extra, and the tool says so instead of returning broken bytes.

If the decoded bytes are readable text, you see the text and can copy it or swap it back. If they are a file, a green box names the type and offers a download, as described below. In Decode mode the file button reads Open a .txt file: choose a .txt or .b64 file holding encoded text and its contents are loaded into the box.

Pasted an encoded string into Encode mode by mistake? When the text looks encoded, a hint appears under the box with a Decode it instead link.

The standard alphabet uses + and /, and both mean something in a web address: + can turn into a space, and / separates folders. The URL-safe variant, defined in RFC 4648, swaps them for - and _. It is what JSON Web Tokens, many API keys, signed links and file names use.

Tick URL-safe (- and _) in Encode mode to get it. This base64 url safe form, often written base64url, usually goes together with no padding, because = also needs escaping in a URL. Untick Padding (=) as well when a format asks for both.

In Decode mode there is nothing to tick: both alphabets are read automatically, and the note says URL-safe alphabet when - or _ was found. If you want to keep the standard alphabet and put the value in a query string anyway, percent-encode the result with URL Encode.

The = signs at the end only say how many bytes the last group had. A decoder can work that out from the length, so many formats leave them out. JWTs, URL-safe tokens and some APIs expect no padding; email, PEM files and most libraries write it.

To base64 encode without padding, untick Padding (=). A one-byte remainder then ends in 2 characters instead of 2 plus ==, and a two-byte remainder in 3 characters instead of 3 plus =. Nothing else in the output changes.

Decoding works either way. If padding is missing, the tool adds it back and says missing padding added, so you can paste a token straight from a URL.

Line breaks splits long output into lines. Every 76 (MIME, email) follows the email standard used for attachments. Every 64 (PEM) matches certificate and key files that sit between -----BEGIN and -----END lines. None, the default, gives one long line, which is what JSON, HTML and most code want. Lines end with CRLF, as both standards specify.

As data: URI adds a prefix so the result can be used directly as a link or an image source. For a file it uses the file's own type, such as image/png or application/pdf; for text it uses text/plain with the charset you chose. For files, line breaks are left out in this mode, because a data URI should be one piece.

Each line separately treats every line of the input as its own value. Paste a list of ten strings and you get ten encoded lines back, in the same order, instead of one block. It works in Decode mode too, which is handy for a column copied from a spreadsheet or a log. It is not available for files.

Press Encode a file, or drop a file on the left box, to turn it into text. Any type works: PDF, ZIP, fonts, audio, Word documents, certificates. The file is read by your browser, so a large one takes a moment, but it never leaves your device.

When you base64 encode file contents, the same options apply: URL-safe, Padding, Line breaks and As data: URI. Each line separately is switched off, because a file is one value. The size line shows the original size, the encoded size and the increase, about +33%.

Long results are awkward to copy, so Download as .txt saves the output as a text file named after the original, for example report.pdf.b64.txt. Press Remove file, type text instead to go back to typing.

One practical note: very large outputs are heavy for a browser text box and for whatever you paste them into. Putting a 20 MB video into a web page or a JSON body as text is rarely a good idea; link to the file instead.

A common reason to base64 encode image files is to put a small icon or logo straight into HTML, CSS, an email template or a JSON payload, with no separate file to load. Drop the image, tick As data: URI, and copy the result into an img src attribute or a CSS url().

This page treats an image like any other file. For image-only work, Image to Base64 is made for the job, with ready-made HTML and CSS snippets. Shrinking the picture first matters, since the text is a third bigger than the file; Compress Image and Resize Image help with that.

Inline images work best when they are small, a few kilobytes at most. Bigger ones make every page load heavier, cannot be cached on their own and delay the first paint. SVG icons are often better pasted as plain SVG markup.

Encoded text does not say what it contains, but most file formats begin with a fixed signature, sometimes called magic bytes. After decoding, the tool checks those first bytes. If it finds a known one, a green box shows the type and size, a preview when the browser can show or play it, and a Download button that saves the file with the right extension, such as decoded.pdf.

So to base64 decode file data from an API response, an email source or a database field, paste it in Decode mode and press Download. If no signature matches and the bytes are not valid text, the box says Binary data and saves decoded.bin.

Word, Excel and PowerPoint files are ZIP archives inside, so the tool looks a little deeper to tell them apart. Previews are made for files under 60 MB; bigger ones can still be downloaded. Once saved, Office files open in their usual apps, or you can turn them into PDFs with Word to PDF and Excel to PDF.

PDFs are often sent as encoded text: e-signature and invoicing APIs, shipping label services and raw email sources all do it. To base64 decode to pdf, paste the string, with or without its data:application/pdf prefix, in Decode mode. Encoded PDFs start with JVBERi0, which is %PDF- encoded.

The PDF opens right in the page so you can check it is the right document, and Download .pdf saves it. If the viewer stays blank, the data may be cut short or damaged: check that the whole string was copied, and try Repair PDF on the saved file.

Need the text or the pages out of it afterwards? PDF to Text, PDF to JPG and Compress PDF work on the saved file.

Encoded images turn up in HTML source, CSS, JSON from APIs and chat exports. To base64 decode to image, paste the string in Decode mode; a data:image prefix is fine. PNG, JPG, GIF, WebP, AVIF, BMP, ICO and SVG are recognised and shown, and Download saves the file with its extension. HEIC is recognised too, but most browsers other than Safari cannot show it, so download it and use HEIC to JPG.

A few telltale starts help when you are not sure what you have: iVBORw0KGgo is a PNG, /9j/ is a JPG, R0lGOD is a GIF, and UklGR is a RIFF file such as WebP or WAV.

For pictures only, Base64 to Image is the dedicated tool, and Convert Image changes the saved file to another format.

Sometimes the decoded value is not text or a file but raw bytes: a hash, a key, an ID, a signature or a binary protocol message. To base64 decode to hex, decode as usual and switch View from Text to Hex.

The hex view shows 16 bytes per row: the offset on the left, the bytes as hex pairs in the middle and the printable characters on the right, with dots for the rest. It shows the first 4 KB, enough to inspect a file header or a short value.

This is also how you compare two forms of the same hash. A SHA-256 written as 44 characters ending in one = is 32 bytes, and the hex pairs in the view are the 64-character hex form you see on download pages, with spaces between them. The Hash Generator can give you either form directly.

The same conversion is built into every operating system. Results match this page as long as the input bytes match.

Three habits cause most mismatches. echo adds a newline at the end, so use echo -n or printf when you pipe text in. The Linux tool wraps its output at 76 characters unless you add -w 0. certutil writes -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- lines around its output, which you remove before using the text elsewhere.

For text in PowerShell, turn the string into bytes first with [Text.Encoding]::UTF8.GetBytes("text"). For -EncodedCommand, use [Text.Encoding]::Unicode instead, which matches the UTF-16 LE option here.

In JavaScript, btoa() encodes and atob() decodes, but they only accept characters 0 to 255, like the Latin-1 option here, so btoa("€") throws an error. For real text, turn it into UTF-8 bytes with TextEncoder first, as in the table, and read the bytes back with TextDecoder. The spread in the first line is fine for short strings; for large data, convert in chunks.

Python's standard module has b64encode and b64decode for the standard alphabet and urlsafe_b64encode and urlsafe_b64decode for the URL-safe one. They work on bytes, so encode text first, and they keep the padding; strip the = signs yourself if a format wants none. In Node.js, Buffer does both directions, and the base64url option gives the URL-safe form without padding.

Encoding and decoding happen in this page, in your browser, with the page's own code. Text, tokens and files are not uploaded, not logged and not put in the address bar. Previews of decoded files are temporary local links that only your browser can open.

The page remembers only your settings, such as Mode, Text encoding and the encode options, in this browser's local storage. Your text and files are never saved. You can clear the stored settings in your browser's site data.

Remember the other half of safety: the encoded text itself protects nothing. Anyone you share it with, or anyone who sees it in a log, can read it.

Working with web data? URL Encode makes values safe for query strings, the JWT Decoder reads tokens, the JSON Formatter tidies decoded JSON, and the Hash Generator makes SHA-256 or MD5 checksums in hex or in this encoding.

Got a file out of the decoder? Compress PDF, PDF to Word or Convert Image are good next steps, depending on what you saved.