Base64 encode and decode
Paste text to encode, or Base64 to decode. It happens here in the page, which is worth knowing when the string you are decoding is a token.
Encoding and decoding happen in this tab, so a token you paste stays on your machine.
How to use it#
- Choose whether you are going text to Base64, or Base64 back to text.
- Type or paste into the first box. The result appears as you type.
- Tick URL-safe if the output goes into a URL or a filename, then copy it.
What Base64 is actually for#
Base64 rewrites arbitrary bytes using 64 characters that survive systems designed for text: email bodies, JSON strings, HTML attributes, environment variables. It exists so binary data can travel down a pipe that only accepts text.
It is not encryption and offers no protection at all. Anyone can decode it in a second, on this page or any other. If the content needs to stay secret, it needs to be encrypted before it is encoded.
URL-safe Base64#
Standard Base64 uses + and /, both of which mean something else inside a URL, and pads with = signs that often get mangled. The URL-safe variant swaps them for - and _ and drops the padding.
This is what you will find in JWTs, OAuth state parameters and signed URLs. Decoding here accepts either form, so you rarely need to know which one you were handed.
Unicode, and why some tools break on it#
The browser primitive behind most Base64 tools handles only Latin-1, so the moment an emoji or an accented character appears it throws. Plenty of sites fail outright on it, and some mangle the text without telling you.
This tool converts your text to UTF-8 bytes first and decodes strictly on the way back, so "café ☕" survives a round trip intact and genuinely invalid input is reported as an error rather than returned as mojibake.
Frequently asked questions#
Is Base64 a form of encryption?
#
No. It is an encoding, fully reversible by anyone without a key or a secret. A Base64 string should be treated as though it were written out in plain text.
What is URL-safe Base64?
#
A variant that replaces + with -, / with _, and usually drops the = padding, so the result can sit in a URL or filename unescaped. JWTs use it.
Why do I get an error decoding a valid-looking string?
#
Either the string is not valid Base64, or it decodes to binary rather than text: an image or a compressed blob, say, which has no meaningful text representation.
Does it handle emoji and accented characters?
#
Yes. Text is converted to UTF-8 bytes before encoding and decoded strictly afterwards, so any Unicode survives a round trip.
Is it safe to paste a token here?
#
Safer than on a server-side tool: the string is processed in this tab and never transmitted. Even so, treat any token you have pasted anywhere as worth rotating if it protects something valuable.