Skip to content
BassoHub
Tools

Base64 encoder and decoder

Encode and decode Base64 online for free: text with accents and emoji (UTF-8), files and images, data URLs and the URL-safe variant. All in your browser.

Base64 encoder and decoder

What to convert
Direction

For URLs, file names and JWT tokens.

The email (MIME) and PEM key format.

Everything runs in your browser: text and files are never sent to a server, aren't stored, and the tool works offline once loaded.

How to use

  1. On the Text tab, choose Encode and type or paste your content: the Base64 shows up instantly, no button needed. Accents, emoji and any language work, because the text is converted to UTF-8 first.
  2. To go the other way, choose Decode and paste the Base64. It can include line breaks and spaces, miss the trailing =, use the URL-safe alphabet or carry a data:...;base64, prefix: the tool handles all of that.
  3. Swap sends the result back to the input and flips the direction, which is handy to check that the round trip matches.
  4. On the File tab, pick a file (or drag it onto the dashed area) to get raw Base64 or a data URL ready to paste into HTML, CSS or JSON. In the other direction, paste Base64 to rebuild the file: the type is detected from the first bytes (PNG, JPEG, PDF, ZIP, MP3 and more), images get a preview and you download it with any name you like.

If the Base64 contains an invalid character, the tool tells you its exact position (line and column), and Go to error selects that character in the field.

What Base64 is (and why it's 33% bigger)

Base64 is a way to represent arbitrary bytes using only 64 safe characters: A–Z, a–z, 0–9, + and /. Every 3 bytes (24 bits) of the original become 4 characters of 6 bits each. That's why the result is always about 33% larger than the original. When the byte count isn't a multiple of 3, the end is filled with one or two = signs, known as padding.

It exists because many channels were designed for text: email, JSON, XML, URLs, HTTP headers. Sending a raw image through them would corrupt the bytes; as Base64, it arrives intact.

When to use it

  • Data URLs: embed a small icon straight into HTML or CSS (data:image/png;base64,...) and save a request. For large images it doesn't pay off: the file gets bigger and can't be cached separately.
  • Email (MIME): attachments travel as Base64 in 76-character lines. The "Wrap lines every 76 characters" option produces exactly that format, which PEM keys and certificates use too.
  • JSON APIs: JSON has no binary type, so files and signatures usually travel as Base64 strings.
  • HTTP Basic authentication: the Authorization: Basic header carries user:password in Base64. Note that this is just encoding and anyone can decode it, which is why Basic Auth is only acceptable over HTTPS.

The URL-safe variant

The + and / characters have special meaning in URLs and file names. The URL-safe variant (RFC 4648, section 5) replaces + with - and / with _, and usually drops the trailing =. It's what JWT tokens, password-reset links and short identifiers use. Tick "URL-safe" when encoding; when decoding, the tool recognizes the alphabet on its own.

Common pitfalls

  • Thinking Base64 is encryption. It isn't: there's no key or secret, and anyone can reverse it in a second. To protect data, use real encryption.
  • Broken accents with btoa. JavaScript's btoa() only accepts Latin-1 characters and fails (or produces garbage) with "é", "ñ" or emoji. The right approach is converting the text to UTF-8 first, as this tool does. If a Base64 string decodes to "é" instead of "é", it was probably produced as Latin-1.
  • Line breaks and spaces pasted along aren't errors: the decoder ignores them, including the invisible spaces that come from PDFs and e-mails (non-breaking, zero-width). Base64 copied from a URL, with %2B, %2F and %3D instead of +, / and =, is read too. A character outside the alphabet, though (like a * or an ç), means the text is corrupted.
  • A + that became a space. Standard Base64 put into a URL without encoding loses its + signs: the server reads each one as a space, and the result comes out wrong with no warning. In URLs, use the URL-safe variant.
  • Padding: = may only appear at the end, at most twice. Base64 truncated while copying often leaves one character over, which is impossible, and the tool flags it as "impossible length".
  • Mixed alphabets: text with both + and - is usually two different snippets glued together.

Privacy

All conversion happens in your browser. Text and files are never sent to a server, nothing is stored and, once the page has loaded, the tool even works offline. Still, remember that Base64 hides nothing: treat a Base64-encoded password or document with the same care as the original.