Base64 Encode and Decode Online

Q: What is URL-safe Base64?

A variant, often called base64url , that replaces + with -, / with _, and usually drops the = padding, so the result can sit in a URL or filename unescaped. JWTs use it.

How to use it#

Choose whether you are going text to Base64, or Base64 back to text.
Type or paste into the first box. The result appears as you type.
Tick URL-safe encoding if the output goes into a URL or a filename, then copy it. Decoding reads either form, so the option greys out there.
If the Base64 holds a file rather than text, the result says what kind and offers it as a download.

What Base64 is actually for#

Base64 rewrites arbitrary bytes using 64 characters that survive systems designed for text: email bodies, JSON strings, HTML attributes, environment variables. It exists so binary data can travel down a pipe that only accepts text.

It is not encryption and offers no protection at all. Anyone can decode it in a second, on this page or any other. If the content needs to stay secret, it needs to be encrypted before it is encoded.

URL-safe Base64#

Standard Base64 uses + and /, both of which mean something else inside a URL, and pads with = signs that often get mangled. The URL-safe variant swaps them for - and _ and drops the padding.

This is what you will find in JWTs, OAuth state parameters, and signed URLs. Decoding here accepts either form, so you rarely need to know which one you were handed.

Unicode, and Base64 that is not text#

The browser's built in Base64 functions, btoa and atob, handle only Latin-1, so an emoji or an accented character makes btoa throw. This page converts your text to UTF-8 bytes first and decodes strictly on the way back, so "café ☕" survives a round trip intact.

Decoding strictly also means bytes that are not text are never shown as a screen of garbled characters. When the Base64 holds an image, a PDF, or a zip, the result says so, names the kind of file it looks like from its first few bytes, and offers it as a download with the right extension. A pasted data URI works too, header and all. To see a picture on the page rather than download it, use Base64 to image.

Frequently asked questions#

Is Base64 a form of encryption?

No. It is an encoding, fully reversible by anyone without a key or a secret. A Base64 string should be treated as though it were written out in plain text.

What is URL-safe Base64?

A variant, often called base64url, that replaces + with -, / with _, and usually drops the = padding, so the result can sit in a URL or filename unescaped. JWTs use it.

What happens when the Base64 is a file rather than text?

The result names the kind of file the bytes look like, such as a PNG image or a PDF, and a Download button saves it with that extension. Anything it does not recognise saves as .bin. For a picture, Base64 to image shows it on the page, and image to Base64 goes the other way.

Why does it say my string is not valid Base64?

It has a character outside the Base64 alphabet, or it has been cut short. The alphabet is letters, digits, + and /, with - and _ in the URL-safe form, and = as padding at the end. Spaces, line breaks, and a data URI header such as data:image/png;base64, are fine, since they are removed before decoding.

Does it handle emoji and accented characters?

Yes. Text is converted to UTF-8 bytes before encoding and decoded strictly afterwards, so any Unicode survives a round trip.

Is it safe to paste a token here?

The string is processed in this tab and never transmitted. Even so, treat any token you have pasted anywhere as worth rotating if it protects something valuable.