What is Base64 encoding?
Base64 is a way of representing binary data using only 64 printable ASCII characters:A–Z a–z 0–9 + /plus=for padding. It takes three bytes of input at a time, splits those 24 bits into four six-bit groups, and maps each group to one character. That is why Base64 output is always about 33% larger than the input: you are spending four characters to carry three bytes.
It is worth being clear about what Base64 is not. It is not encryption and it is not compression. Anyone can decode it instantly, which is exactly what the decoder above does. Base64 is a transport format: it lets binary data survive a trip through systems that only expect text.
When you actually need it
The most common case is HTTP Basic Authentication, whereusername:passwordis Base64-encoded into the Authorization header. Because that encoding is trivially reversible, Basic Auth is only safe over HTTPS. You will also hit Base64 in data URIs that inline a small image directly in CSS or HTML, in email attachments via MIME, in the header and payload segments of a JWT, and in Kubernetes Secrets, where values are stored Base64-encoded and are routinely mistaken for encrypted ones.
How to use this tool
Paste or type into the left panel and the result appears on the right as you type. Hit decode to go the other direction, or use the swap button between the panels to feed the output straight back in as new input, which is the fastest way to sanity-check a round trip. Drop a file anywhere on the input panel to encode its raw bytes. Toggle url-safe when the result has to live in a URL or filename: it swaps+for-,/for_, and drops the trailing padding.
Doing it in code
In the browser,btoa()andatob()only handle Latin-1, so any character above U+00FF throws. Convert to UTF-8 bytes first:
const bytes = new TextEncoder().encode("café · 🚀");
const b64 = btoa(String.fromCharCode(...bytes));
const back = new TextDecoder().decode(
Uint8Array.from(atob(b64), (c) => c.charCodeAt(0))
);In Node, skip all of that and useBuffer.from(str).toString("base64"), which is UTF-8 aware by default and supports"base64url" for the URL-safe variant. Python users wantbase64.b64encode(s.encode()).
Three mistakes worth avoiding
The first is treating Base64 as a security measure. Encoding a password, an API key, or a config value hides nothing: it is a public, reversible mapping, and a Kubernetes Secret is protected by cluster access control, not by the encoding. If a value needs to stay private, encrypt it.
The second is inlining large assets as data URIs. Base64 adds roughly a third to the payload, and an inlined image cannot be cached separately from the document that carries it, so the browser re-downloads it on every page load. Inline tiny icons if you must; serve anything bigger as its own cacheable file.
The third is mixing up the standard and URL-safe alphabets. If a token arrives with-or_in it, a strict standard decoder will reject it outright. The decoder above accepts both alphabets and restores missing padding, which is usually why a token that failed elsewhere decodes fine here.
Frequently asked questions
Is this Base64 encoder safe for sensitive data?+
Yes. Encoding runs entirely in your browser using the built-in TextEncoder and btoa APIs. Your input is never sent to a server, so nothing is logged or stored.
Does it support UTF-8 and emoji?+
It does. Text is converted to UTF-8 bytes before encoding, so accented characters, emoji, and non-Latin scripts round-trip correctly.
What is URL-safe Base64?+
URL-safe Base64 replaces + with - and / with _ so the output can be used in URLs and filenames without escaping. Toggle it on and the encoder emits that variant.
Why does my decode fail?+
Base64 input must have a valid length and character set. Stray spaces are stripped automatically, but truncated strings or missing padding will be rejected.