Base64 Encoder & Decoder

Base64 turns arbitrary bytes into a string made of 64 safe characters, so data can travel through channels that only reliably carry text — an email body, a URL, a JSON field, an HTTP header.

This encoder handles Unicode correctly, which many do not. Emoji, accented letters and non-Latin scripts all encode and decode back to exactly what you put in, because the text is converted to UTF-8 bytes first rather than being fed to a function that assumes one byte per character.

It also works on files. Pick one and get its Base64, a complete data: URL or a ready-made CSS url() value; paste a data URL the other way and download the file it contains. The file is read by the page in your own browser, so nothing is uploaded and nothing needs a network connection.

A data URL carries the bytes of a file inside the URL itself: data:, then the media type, then ;base64, then the payload. Anywhere a browser expects a URL — an img src, a CSS background, an email template — it will take one of these instead and skip the request entirely.

That is the real reason to reach for it. A small icon inlined as a data URL costs no round trip, which on a cold connection is worth far more than the bytes it adds. It is also the only way to embed an image in an HTML email that some clients will not fetch, or in a single-file document that has to work offline.

The trade is caching. An inlined asset is re-downloaded with every copy of the page that contains it and can never be cached separately, so the technique pays for small, stable files — logos, icons, a woff2 subset — and quietly costs you on anything large or frequently changed.

About a third. Base64 encodes three bytes as four characters, so the output is 4/3 the size of the input, rounded up — a 300 KB image becomes roughly 400 KB of text before any wrapper is added.

The rounding is what the equals signs at the end are for. When the input length is not a multiple of three, the final group is padded and the output records how much padding was added, which is how a decoder knows whether the last group carried one byte, two, or three.

URL-safe Base64 goes further and drops the padding altogether, as well as swapping plus and slash for hyphen and underscore, because those two characters are reserved in URLs. Both forms decode here; if a string from a JWT or a query parameter fails elsewhere, that variant is usually why.

It is an encoding, and a completely reversible one. Anyone who sees a Base64 string can decode it in a second — it hides nothing, and a string that looks scrambled is not the same as a string that is protected.

This is worth stating plainly because Base64 is regularly misused as though it were a security measure. Credentials in a Base64-encoded config file are stored in plaintext with an extra step. If something needs to be secret, it needs to be encrypted.

The browser's built-in btoa function only accepts characters in the range 0–255. Hand it an emoji or a Devanagari character and it throws an error, which is why so many online encoders either fail or quietly produce something that will not decode back.

The correct sequence is to encode the text as UTF-8 bytes first, then Base64-encode those bytes, and reverse both steps on the way out. That is what this tool does, so a round trip returns your input character for character.