Is Base64 encryption?

No. Base64 is an encoding, not encryption. Anyone can decode a Base64 string back to its original bytes instantly. Never use Base64 as a security measure for passwords, secrets, or personal data.

Why is Base64 output longer than the input?

Base64 represents 3 bytes of input as 4 bytes of output, so encoded data is about 33% larger than the original. This is the cost of being transport-safe in text-only channels.

What's URL-safe Base64?

A variant that uses -_ instead of +/ and drops the trailing = padding. It avoids the need for percent-encoding when the Base64 string appears inside a URL path or query parameter. JWT tokens use URL-safe Base64.

Can I Base64 encode an image?

Yes. Click 'Encode a file' in the encode tab, select the image, and the tool returns a complete data URL (data:image/png;base64,...) ready to paste into an img tag or CSS. Keep data URLs small — large ones bloat HTML and bypass browser caching.

Why does my Unicode text decode incorrectly elsewhere?

Base64 operates on bytes, so Unicode must be encoded to UTF-8 before Base64 encoding. This tool does that automatically. Command-line tools often don't — verify that both sides use UTF-8 and you'll get consistent results.

Is there a size limit?

For text input there's no practical limit. For file encoding we cap at 25 MB to keep browser memory usage reasonable. For anything bigger, use a desktop tool like base64 from the coreutils package.

Base64 Encoder/Decoder

Encode and decode Base64 text and files, URL-safe variant included.

Encoding and decoding run in your browser. Your text and files stay on your device.

URL-safe Base64 (-_ instead of +/)

Plain text or file

Base64 output

SGVsbG8sIHNpbXBsZXRvb2wuaW8h

28 characters · 0.03 KB

Similar tools

URL Encoder/Decoder

Percent-encode and decode URLs or just components.

HTML Encoder/Decoder

Escape and unescape HTML entities in any string.

JSON Tree Viewer

Validate, format, and interactively explore any JSON document.

What is a Base64 Encoder/Decoder?

Base64 is a way to represent arbitrary binary data as ASCII text. It takes three bytes at a time and turns them into four printable characters drawn from a 64-character alphabet (A–Z,a–z, 0–9, plus + and /). The result is roughly 33% longer than the source, but it is safe to place in anywhere text is expected: HTTP headers, JWT tokens, email bodies, JSON strings, src attributes on images, and the like.

A crucial misconception first: Base64 is not encryption. It scrambles nothing and protects nothing — anyone who has the Base64 string can decode it back to the original bytes with this tool, a terminal, or a programming language one-liner. Treat it as a transport format, not a security control. Passwords, secret keys, and personal data should never be stored or sent "base64-encoded" as a stand-in for proper encryption.

Common uses. Data URLs inline a small image directly into HTML or CSS (data:image/png;base64,...), avoiding a round-trip HTTP request at the cost of larger HTML and uncacheable bytes. JWT tokens Base64-encode the header and payload sections so they can travel in an Authorization header. Email attachments (MIME) Base64-encode binary files so they survive legacy 7-bit text channels. HTTP Basic Auth Base64-encodes username:password — again, not for security, just so the colon-separated string can live in a header.

URL-safe Base64 is a variant that replaces + and / with - and _, and strips the trailing = padding. This makes the string safe to use inside a URL path or query parameter without percent-encoding. JWT and many modern web APIs use URL-safe Base64 by default; toggle the option above to match what your system expects.

Unicode in, Unicode out. Base64 itself operates on bytes, not characters, but this tool runs the text through a UTF-8 encoder before encoding, and through a UTF-8 decoder after decoding. The result: emoji, Chinese characters, and any other Unicode round-trip correctly. If you encode in a terminal (echo "café" | base64) and try to decode the result here, make sure your terminal was also using UTF-8.

File-to-Base64 is useful for inlining images and small assets. Drop a file into the encode tab and the tool returns a complete data URL (data:image/png;base64,iVBOR...) ready to paste into an img tag or a CSS background. Keep data URLs small — they bloat HTML and break browser caching. Anything above ~10 KB should typically stay as a separate asset.

How to use the Base64 Encoder/Decoder

Pick encode or decode. Encode turns text (or a file) into Base64; decode reverses it.
Paste your input. Type or paste text. For file encoding, click "Encode a file" to pick one from disk.
Toggle URL-safe if needed. Turn this on to replace +/ with -_. Match the format your target system expects.
Copy or download. The output panel shows the result with live byte size.
Swap direction. Click the swap button to move the output into the input and flip modes.

Features

Text and file encoding to Base64.
URL-safe Base64 toggle for JWT and modern web APIs.
UTF-8-safe — emoji, Chinese, and any Unicode round-trip cleanly.
Data URL output when encoding a file.
Swap button to flip input and output.
Runs in your browser — your text and files stay local.

Frequently asked questions

Is Base64 encryption?: No. Base64 is an encoding, not encryption. Anyone can decode a Base64 string back to its original bytes instantly. Never use Base64 as a security measure for passwords, secrets, or personal data.
Why is Base64 output longer than the input?: Base64 represents 3 bytes of input as 4 bytes of output, so encoded data is about 33% larger than the original. This is the cost of being transport-safe in text-only channels.
What's URL-safe Base64?: A variant that uses -_ instead of +/ and drops the trailing = padding. It avoids the need for percent-encoding when the Base64 string appears inside a URL path or query parameter. JWT tokens use URL-safe Base64.
Can I Base64 encode an image?: Yes. Click 'Encode a file' in the encode tab, select the image, and the tool returns a complete data URL (data:image/png;base64,...) ready to paste into an img tag or CSS. Keep data URLs small — large ones bloat HTML and bypass browser caching.
Why does my Unicode text decode incorrectly elsewhere?: Base64 operates on bytes, so Unicode must be encoded to UTF-8 before Base64 encoding. This tool does that automatically. Command-line tools often don't — verify that both sides use UTF-8 and you'll get consistent results.
Is there a size limit?: For text input there's no practical limit. For file encoding we cap at 25 MB to keep browser memory usage reasonable. For anything bigger, use a desktop tool like base64 from the coreutils package.