Base64 Encoder / Decoder

What is Base64 actually for?

Base64 solves one problem: moving bytes through a channel that only accepts text. It takes any data and rewrites it using 64 characters that survive almost anywhere, so binary content can travel where only plain text is allowed.

That comes up constantly. Email attachments are Base64 inside the message body. Images get embedded in CSS and HTML as data URIs. API payloads carry files inside JSON. Certificates and keys ship as PEM, which is Base64 wrapped in header lines. Session tokens and JWTs are Base64 segments joined by dots.

How do I encode and decode here?

Choose Encode or Decode, then give the tool something to work with.

• Encoding text — paste it in the left box and the Base64 appears instantly on the right.
• Encoding a file or image — switch the source to "File or image" and drop the file in. You get the raw Base64, the complete data URI, a CSS background-image rule, and an HTML img tag, each on its own tab with a copy button.
• Decoding — paste the Base64 on the left. If it decodes to text, you see the text. If it decodes to a file, you get the detected type, the size, the pixel dimensions for images, a preview, and a download button.

The URL-safe switch matters when the result goes into a link or a filename. It swaps + for -, / for _, and drops the = padding, which are the three things that break Base64 inside a URL.

Why does line-wrapped Base64 fail on other tools?

Because a lot of tools count the line breaks when they calculate padding, then reject a string that was perfectly valid.

Base64 from the real world is almost always wrapped. MIME wraps at 76 characters, PEM certificates wrap at 64, and email clients wrap wherever they please. This tool strips every space, tab and newline before it does anything else, so a certificate pasted straight out of a terminal decodes normally. It also accepts a full data:image/png;base64,… string with the prefix still attached, which is what you get when you copy an embedded image out of browser dev tools.

Encoding is not encryption

Base64 protects nothing. It is a reversible representation, not a cipher, and anyone can decode it in one step, exactly as this page does. If you found a Base64 string in a config file and it looked scrambled, it is not secret; it is just packaged.

The confusion is common enough to cause real incidents. Credentials "hidden" in Base64 inside a repository, a mobile app bundle, or a browser payload are plain text with extra steps. Use real encryption when something must stay private, and reach for Base64 only when the job is transport.

How much does Base64 cost you in size?

About a third. Every three bytes become four characters, so the output is roughly 133 percent of the input, plus up to two padding characters. This page shows both sizes and the exact difference, so you can decide with a number instead of a guess.

That overhead is the whole argument about embedding images in CSS. A 2 KB icon becomes about 2.7 KB of text, which is a fine trade for removing a network request. A 400 KB photograph becomes roughly 533 KB that cannot be cached on its own and delays the stylesheet from rendering. Small and static, embed it. Large or reused, keep it as a file.

Does Unicode survive the round trip?

Yes, because the encoding runs through UTF-8 rather than the browser's older byte-by-byte path. Accented letters, Greek, Cyrillic, Chinese, and emoji all come back exactly as they went in.

This is where a lot of quick Base64 snippets break. The classic one-liner using btoa throws an error the moment it meets a character above the Latin-1 range, which is why so many scripts fall over on a simple é or a 🚀. Encoding the text to UTF-8 bytes first, then converting those bytes, is the correct order, and it is what happens here.

Does anything leave my browser?

No. Text, files and images are all processed locally with JavaScript, using the browser's own file reader and text encoder. There is no upload, no server call, no logging and no storage, and the page keeps working offline once it has loaded.

That makes it safe for things you should not paste into a random website: internal API responses, private keys, signed tokens, customer documents. Files are capped at five megabytes, not for privacy but because a data URI that large makes the page sluggish, and a clear message is better than a frozen tab.