Base64 Encoder and Decoder
Base64 encoder and decoder: encode text or files to Base64 and decode it back, with UTF-8 and URL-safe modes. Free, no sign-up, and it runs in your browser.
Dedicated page: /en/base64-encoder-decoder
Quick answer
Base64 encoding converts text or binary data into a safe string of letters, numbers, plus and slash characters, so it can travel through email, URLs and JSON without corruption. This tool encodes and decodes Base64 both ways, with a URL-safe mode and clear errors for invalid input.
About this Base64 Encoder and Decoder
Base64 encoder and decoder: encode text or files to Base64 and decode it back, with UTF-8 and URL-safe modes. It is one of the Developer Tools on ToolUstad, and like every tool here it runs entirely in your browser: nothing you type, paste or open is uploaded to a server, and there is no sign-up or usage limit.
What is Base64?
Base64 is an encoding scheme that represents binary data using 64 printable characters: A to Z, a to z, 0 to 9, plus and slash, with equals signs as padding. Every three bytes of input become four characters of output, so the encoded version is about 33 percent larger. It exists because many systems, from email (MIME) to URLs and JSON, were built for text and mangle raw binary. Base64 is encoding, not encryption: anyone can decode it.
Where Base64 is used
| Use | Why Base64 |
|---|---|
| Email attachments (MIME) | Mail systems were designed for text only |
| Data URIs in CSS and HTML | Embeds small images directly in the file |
| Basic authentication headers | Sends credentials as one text token |
| JWT tokens | Header and payload use Base64URL encoding |
| API payloads and webhooks | Carries binary or special characters inside JSON strings |
Standard vs URL-safe Base64
Standard Base64 uses plus and slash, which have special meanings in URLs, and pads output with equals signs. The URL-safe variant swaps plus for minus and slash for underscore, and often drops the padding. Pick the variant your system expects: decoding with the wrong one is the most common cause of garbage output, and this tool offers both, plus automatic handling of missing padding.
Best practices
- Never treat Base64 as security: use it for transport, and real encryption for secrecy.
- Check the character set your API expects before decoding JWTs or webhook payloads.
- Encode UTF-8 text properly: characters beyond ASCII need byte encoding first, which this tool handles.
Common mistakes to avoid
- Decoding a string with line breaks or spaces copied from an email and assuming it is corrupt.
- Forgetting that encoded output is a third larger, which matters for very large files.
- Double encoding data that was already encoded, producing nonsense on a single decode.
Who is the Base64 tool for?
Developers debugging tokens and payloads, email engineers, system administrators moving data between systems, and students learning how encoding works. Command line tools do the same job, but only if you remember the flags for each operating system and variant, while this page handles both directions and both alphabets in one place.
A quick worked example
The word "ToolUstad" encodes to VG9vbFVzdGFk. Notice there is no padding, because the 9 byte input divides exactly into three byte groups. Encode "hi" instead and you get aGk=, where the equals sign pads the short final group. Try both directions in the tool above: decode aGVsbG8sIHdvcmxk and you will get "hello, world". Examples like these are the fastest way to confirm which variant a system handed you: if the string contains minus or underscore characters, it is the URL-safe alphabet, and the standard decoder setting would garble it.
Learn: how to use the Base64 Encoder and Decoder
- Pick Encode or Decode at the top.
- Paste text or Base64, or choose a file to encode it. Then click Convert.
- Copy the result. If you decoded binary data like an image, save it with the download-as-file box instead.
Features
- Encode and decode both ways, with correct UTF-8 handling for accents and emoji
- URL-safe alphabet option for tokens and URLs, standard alphabet otherwise
- Encode any file up to 8 MB to a Base64 string
- Decode Base64 back into a downloadable file
- Clear validation errors that name the exact problem
Worked example
Hello, ToolUstad! encodes to SGVsbG8sIFRvb2xVc3RhZCE=. Decoding that string returns the original text exactly.
Frequently asked questions
Is Base64 encryption?
No. Base64 is an encoding anyone can reverse instantly. It makes binary data safe to carry in text formats like JSON, email and URLs; it does not protect secrets.
Why is the Base64 output longer than the input?
Base64 stores 3 bytes in 4 characters, so output is about 33% larger, plus padding. That overhead is normal and expected.
What does URL-safe mean?
Standard Base64 uses + and /, which break URLs. The URL-safe alphabet swaps them for - and _ and usually drops the = padding. JWTs and many tokens use this variant.
Why did my decode fail?
Common causes: the string was copied with the "data:...;base64," prefix still attached, part of it is missing, or it was never Base64. The error message tells you which case you hit.
Is Base64 encryption?
No. Base64 is a public encoding with no key, and anyone can reverse it instantly. It protects data from corruption in transit, not from readers. Use HTTPS and real encryption, like AES, for anything secret.
Why does Base64 output end with equals signs?
The equals signs are padding. Base64 works in groups of three bytes, and when the input length is not a multiple of three, padding fills the last group so decoders know how many real bytes to output.
What is Base64URL and where is it used?
Base64URL replaces plus with minus and slash with underscore so the output is safe inside URLs and file names without escaping. It is the encoding used in JSON Web Tokens (JWTs) and OAuth flows.
Why is my decoded output unreadable gibberish?
Three causes cover almost every case: the input was encoded with the URL-safe alphabet while the decoder expected standard, the string was encoded twice so it needs a second decode, or the original data was not text at all but a binary file, whose decoded bytes will never read as words. Check the alphabet first, then try decoding once more, then reconsider what the original payload actually was.
Related tools
More Developer Tools like this one, plus two picks from other categories. Each opens its own dedicated page.