Base64 encode and decode
About Base64 Encode / Decode
Base64 encode text or decode Base64 back to text. Base64 writes any data with 64 printable ASCII characters, which is why it appears in JWT segments, data URIs, HTTP Basic auth headers and email attachments.
Encoding goes through UTF-8 first, so emoji, accents and non-Latin scripts work. The result matches Python's base64.b64encode on UTF-8 bytes. A URL-safe toggle gives the - and _ variant used in JWTs and URLs.
Runs in your browser. Nothing is uploaded.
How it works
How Base64 encoding works
Base64 reads the input three bytes at a time and writes each 24-bit group as four characters from A-Z, a-z, 0-9, + and /. If the length is not a multiple of three, = padding fills the last group. The output is about 33% larger than the input.
UTF-8 safety
Text is encoded to UTF-8 bytes before Base64. The browser's btoa alone only accepts Latin-1 and throws on emoji or accented letters. Going through UTF-8 makes every script round-trip correctly.
URL-safe Base64
Standard Base64 uses + and /, which clash with URL syntax. The URL-safe variant (RFC 4648 section 5) uses - and _ instead and drops the = padding. The URL-safe toggle produces it, and decode mode accepts both variants.
Decoding validation
Decode mode strips whitespace, accepts both alphabets and restores missing padding. If the input has invalid characters, or the bytes are not valid UTF-8 text, you get an error instead of garbled output.
Frequently asked questions
Is Base64 encryption?
No. Base64 is an encoding. Anyone can decode it, and no key is involved. Never use it to protect secrets. It only makes data safe to send through text-only channels.
Why is my Base64 output longer than the input?
Base64 writes every 3 bytes of input as 4 characters, so encoded data is about 33% larger.
What is url-safe Base64 and when do I need it?
It replaces + with -, / with _ and drops = padding, so the string can sit in a URL or file name without escaping. JWT segments use it. Turn on the URL-safe toggle to produce it. Decoding accepts both variants.
Can I decode a JWT with this tool?
You can decode one segment at a time, since JWT parts are URL-safe Base64. The JWT decoder shows the header, payload, signature and expiry in one view.
Is it safe to paste tokens or secrets here?
Encoding and decoding run in your browser, and nothing is uploaded or logged. Treat pasted credentials with care anyway.
Learn more
Sources & last verified
We checked this tool's behavior and the claims on this page against the specifications below on . The tool runs in your browser, so the output you see is exactly what the engine produced.
Found a wrong result or an outdated claim? Report an error and we will check it again.
URL Encode / Decode
Timestamp Converter
JSON to Zod
JSON to Pydantic
JSON to Go
JSON to Java