Base64 Encode & Decode

Base64 turns arbitrary bytes into a safe alphabet of 64 characters - the encoding behind data URLs, Basic auth headers, JWT payloads and email attachments. The classic tool trap is UTF-8: naive encoders mangle emoji and non-Latin text. This one round-trips every character correctly in both directions, shows input and output lengths with the 3-bytes-to-4-chars math, and flags genuinely invalid Base64 instead of silently producing garbage.

Decode mode is also a reader: JWT middle sections, data-URI payloads and mystery strings from logs become readable text in one paste. Everything runs locally - credentials in Basic auth strings or tokens inside JWTs never leave the page. Your last input is remembered for iterative work, and the copy button puts the result straight on the clipboard.

โ€“output
โ€“input chars
โ€“output chars
โ€“UTF-8 bytes in
UTF-8 safe: emoji and non-Latin text round-trip correctly in both directions. All local, nothing uploaded.

How to use

  1. Choose encode or decode, then paste your input.
  2. Read the result - lengths, byte counts and the padding math update live.
  3. Copy the output with one tap; errors explain what made the input invalid.

Frequently asked questions

What is Base64 used for?

Moving binary-safe data through text-only channels: embedding images as data URLs, HTTP Basic authentication headers, the parts of a JWT, and email's MIME attachments. It is not encryption - it is a reversible encoding anyone can read, so never treat Base64 as hiding anything.

Why does Base64 make data bigger?

Every 3 bytes (24 bits) become 4 Base64 characters - a fixed 33% overhead, plus = padding to a multiple of 4. A 300-byte input encodes to 400 characters exactly; the stats here show the arithmetic on your own input.

Why do emoji break some Base64 tools?

The naive btoa() works on 16-bit characters, but emoji and many scripts need proper UTF-8 byte conversion first. This tool encodes text โ†’ UTF-8 bytes โ†’ Base64 and reverses exactly that path, so every character round-trips.

Is my input sent to a server?

No. Encoding and decoding run entirely in your browser - which is the right property for a tool you might paste auth headers into. Local-only by design, like every text tool on this site.

Related tools