Base64 Encoder / Decoder Online

What Is This Tool?

Base64 is an encoding scheme that converts binary or text data into a set of 64 safe ASCII characters (A–Z, a–z, 0–9, + and /). It is used everywhere in software: embedding images in HTML/CSS, HTTP Basic authentication headers, email attachments (MIME), JSON Web Tokens, and API payloads that must survive text-only channels.

Important: Base64 is an encoding, not encryption. Anyone can decode it. Its purpose is to make data safe to transmit through systems that only understand text — not to keep it secret.

Base64 is formally specified in RFC 4648, which also defines the URL-safe variant used in JWTs and web APIs: it replaces + with - and / with _ so the encoded string can travel inside a URL without percent-encoding.

Why Use It?

• Decode API tokens, JWT segments and auth headers to see what's inside.
• Encode text for data URIs, config files or HTTP headers.
• UTF-8 safe: emoji and non-Latin characters encode and decode correctly.
• 100% private — the conversion happens in your browser, nothing is uploaded.
• Free, no login, no size limits.

How to Use

1. Type or paste your content into the input box.
2. Click "Encode" to convert text to Base64, or "Decode" to convert Base64 back to text.
3. If decoding fails, the input isn't valid Base64 — check for missing characters or extra whitespace.
4. Click "Copy" to copy the result.

Example

Input

Hello, CodeKitHub! 你好 👋

Output

SGVsbG8sIENvZGVLaXRIdWIhIOS9oOWlvSDwn5GL

Note how the Chinese characters and the emoji survive the round trip — that's the UTF-8 safe part.

Practical tips

• JWT tokens are three Base64 segments joined by dots — decode the first two (header and payload) separately to read them; the third is a binary signature and will look like noise.
• If decoding fails on a JWT segment, that's base64url encoding: replace - with + and _ with / first (standard tools expect the +/ alphabet).
• Whitespace and line breaks inside a Base64 string are usually harmless leftovers from email or logs, but a missing trailing = padding often isn't — check length before assuming the data is corrupt.
• Base64 inflates data by ~33%. Fine for small payloads; for images above a few KB, a real file is nearly always the better choice than a data URI.

Real usage scenarios

The three cases that bring people here daily: reading what's inside an Authorization header or JWT, decoding a webhook/API payload field that arrived Base64-wrapped (often JSON — format it after decoding), and producing a data URI or Basic-Auth string by hand while debugging.

For binary data (images, files), remember what you'll get when decoding as text is mojibake — the data may be perfectly valid, it's just not text. Encode/decode of binary belongs in code; this tool is optimized for the text cases.

How to diagnose a decoding failure

Base64 decoding failures almost always trace back to one of three causes, in order of frequency: the input was actually base64url (uses - and _ instead of the standard + and /, common in JWTs and URL-safe contexts) and needs those characters swapped back before standard decoding will accept it; the string got truncated somewhere along the way (a copy-paste that missed the last few characters, or a log line that got cut off), which is detectable because a valid Base64 string's length is always a multiple of 4 once padding is accounted for; or stray characters (extra whitespace, a stray newline, an accidentally duplicated character) were introduced during copying, which is why pasting directly from a raw source rather than retyping is always safer.

→ JSON Formatter · URL Encoder / Decoder · JWT Decoder

Frequently Asked Questions