Base64 Encoder / Decoder

Base64: how binary data travels through text-only channels

Base64 encodes arbitrary bytes into 64 printable ASCII characters — A–Z, a–z, 0–9, + and / — so binary data can travel through systems that only accept text: JSON payloads, email bodies, XML attributes, HTTP headers, and URLs. The encoded form is about 33% larger than the original, which is the price of safe transport. The conversion below happens in the page itself, so even a credential you are wrapping for a header stays on your machine.

How 3 bytes become 4 characters

The whole algorithm is a regrouping of bits. Take the string Hi! — three bytes with the values 0x48, 0x69, 0x21. Written as binary, that is 01001000 01101001 00100001: 24 bits in groups of eight. Base64 re-slices the same 24 bits into four groups of six — 010010 000110 100100 100001 — giving the decimal values 18, 6, 36 and 33. Each value indexes the 64-character alphabet (0–25 map to A–Z, 26–51 to a–z, 52–61 to 0–9, then + and /), so Hi! encodes to SGkh. Decoding simply runs the regrouping in reverse, which is why the round-trip is exact and lossless.

Padding: what the equals signs mean

When the input length is not a multiple of three, the final group comes up short. The encoder pads the missing bits with zeros and appends = characters so the output stays a multiple of four: Hi (2 bytes) becomes SGk=, and H (1 byte) becomes SA==. The padding carries no data — it just tells the decoder how many real bytes the last group held.

Standard vs. URL-safe Base64

Two of the standard alphabet's characters collide with URL syntax: + means a space in query strings and /separates path segments. The URL-safe variant (RFC 4648 "base64url") swaps them for - and _ and usually drops the padding. JWTs, OAuth tokens, and most modern web APIs use this variant — toggle it below the input when a token refuses to decode as standard Base64.

Common use cases

• Embedding small images in CSS or HTML as data URIs
• Encoding binary data inside JSON payloads
• Storing API keys, secrets, and credentials in environment files
• Creating Basic Auth headers (username:password Base64-encoded)
• JWT segments (which use the URL-safe variant)

Pitfalls to avoid

The classic mistake is treating Base64 as security: it is a reversible encoding, not encryption, so a Base64-encoded password is effectively plaintext. In code, calling raw btoa() on a string with emoji or accented characters throws an exception, because it only accepts single-byte characters — this tool UTF-8-encodes first, which is the standard fix. Also watch for line breaks: MIME wraps Base64 at 76 characters, and stray newlines or whitespace will break strict decoders even though lenient ones ignore them.

When not to use Base64

Avoid it for large files — a 10 MB attachment becomes 13.3 MB of text and loses the benefits of binary compression and streaming. Data URIs make sense for tiny icons, not hero images, since inlined assets cannot be cached separately by the browser. And never use Base64 to hide sensitive values; obscurity that reverses in one click is not protection.

Related tools

• URL Encoder / Decoder — percent-encode strings for safe use in URLs and query strings.
• JWT Decoder — decode the Base64-URL segments of a JSON Web Token and inspect its claims.
• Text to Binary — see the raw bits behind each character, the same bits Base64 regroups.
• Hash Generator — one-way digests for when you need fingerprints, not reversible encoding.