Base64 Encode & Decode

Base64 is a way of writing any data, from a sentence to a photo, using only 64 safe text characters, so it can travel through systems that were built for plain text. Our free tool lets you encode and decode Base64 in both directions. Text is converted as UTF-8, so accents, non-Latin scripts and emoji survive the round trip. You can switch to the URL-safe variant used in web tokens and links, turn any file into Base64 or a ready-made data URI with its size shown, and decode Base64 back into a file you can download. Nothing is uploaded: every conversion happens in your browser.

How to use the Base64 encoder

1. 1 Choose a modeUse the Text tab for words and short strings, File → Base64 to encode a file, or Base64 → file to turn encoded data back into a file.
2. 2 Encode or decode textPick Encode or Decode and paste your input. The result updates as you type, and the Swap button sends the output back as new input to check a round trip.
3. 3 Set the optionsTick URL-safe to use - and _ instead of + and / with no padding, or wrap lines at 76 characters for email (MIME) content.
4. 4 Encode a fileChoose or drop a file to get its Base64, a full data URI, or ready-to-paste HTML and CSS snippets, with the original and encoded sizes shown.
5. 5 Decode to a filePaste Base64 or a data URI. The tool detects the file type, previews images, and lets you download the file with the right extension.

What Base64 is and how it works

Computers store everything as bytes, and a byte can hold any of 256 values. Many older protocols and formats, such as email, URLs, XML and JSON, were designed for text and can mangle or reject bytes that are not ordinary printable characters. Base64 solves this by rewriting data using just 64 characters that are safe almost everywhere: the capital letters A to Z, the small letters a to z, the digits 0 to 9, and the plus and slash signs.

It works by taking the input three bytes at a time. Those 24 bits are split into four groups of six bits, and each group, a number from 0 to 63, is replaced by one character from the alphabet. When the input does not divide evenly into threes, one or two equals signs are added at the end as padding. Decoding simply reverses the process. Because four characters represent three bytes, Base64 output is always about a third larger than the original data.

Base64 and UTF-8 text

Base64 encodes bytes, not letters, so text first has to be turned into bytes using a character encoding. This tool always uses UTF-8, the standard encoding for the web. That means "Café ☕" becomes the bytes for each character, including the two bytes for é and three for the coffee cup, and then those bytes are encoded.

This matters because the browser's own btoa function only accepts characters in the Latin-1 range and throws an error for anything else, such as emoji or Polish, Greek and Arabic letters. Many quick online encoders use it directly and either fail or produce the wrong result. When decoding, the tool checks that the bytes form valid UTF-8 text. If they do not, the data is almost certainly binary, such as an image or a PDF, and you are offered a hex preview and the option to save it as a file instead.

Standard and URL-safe Base64

The plus and slash characters in standard Base64 have special meanings in URLs and file names. A plus can be read as a space in a query string, and a slash looks like a folder separator. The URL-safe variant, defined in RFC 4648, swaps them for a minus sign and an underscore. The padding equals signs are usually dropped as well, because = also has a meaning in query strings.

You will meet URL-safe Base64 in JSON Web Tokens, signed links, some API keys and cloud storage identifiers. Tick URL-safe when you are producing a value for one of these. When decoding, you do not need to choose: the tool accepts both alphabets, with or without padding, and ignores spaces and line breaks.

Data URIs: embedding files in HTML and CSS

A data URI packs a whole file into a single string that starts with data:, followed by the file type, the word base64 and the encoded content. Browsers treat it just like a link to a file, so you can use it in an image tag, a CSS background or a font declaration without a separate download.

Inlining is handy for tiny assets such as a small icon, a loading spinner or an email signature logo, and for self-contained HTML files that must work offline. It is a poor choice for larger images. The encoded file is a third bigger, it cannot be cached separately from the page or stylesheet, and it delays the rest of the HTML from loading. As a rule of thumb, link to anything bigger than a few kilobytes as a normal file. If your site uses a Content Security Policy, data: must also be allowed in the relevant directive, such as img-src, for inlined images to display.

• Data URI: data:image/png;base64,iVBORw0KGgo… for use anywhere a URL is accepted.
• HTML: an img tag with the data URI as its src attribute.
• CSS: a background-image declaration using url() with the data URI.
• Base64 only: just the encoded characters, for APIs and JSON fields that expect raw Base64.

Decoding Base64 back into a file

APIs often return files such as PDFs, invoices, signatures or images as Base64 strings inside JSON, and email attachments are stored as Base64 inside the raw message. To turn one back into a usable file, paste it into the Base64 → file tab. If it begins with a data: prefix, the file type is read from that. Otherwise the tool looks at the first few bytes, which act as a signature for common formats such as PNG, JPEG, GIF, WebP, PDF, ZIP and MP3, and suggests the right extension.

Images are previewed so you can confirm you have the right data before downloading. If the decoded data is plain text, such as JSON or XML, the tool says so, and it falls back to a generic binary file when the format is not recognised. Name the file however you like; the detected extension is added if you leave it off.

If decoding fails, the error message explains why. The most common causes are a character that is not part of the Base64 alphabet, such as a stray quote mark copied from a JSON file, padding in the wrong place, or a string that has been cut short. Check that you have copied the whole value from the very first character to the last, including any equals signs, and that you have not included surrounding text such as a field name or a closing bracket.

Base64 is not encryption

Base64 is often mistaken for a way of hiding information because the output looks like gibberish. It offers no protection at all. There is no key, the method is public, and anyone can decode a Base64 string in seconds with a tool like this one. Basic authentication headers, many configuration files and the payload of every JSON Web Token are only Base64-encoded, so their contents are readable by anyone who can see them.

If you need to keep data private, use proper encryption, and protect it in transit with HTTPS. Treat any Base64 that contains passwords, API keys or personal data with the same care as the plain text. Because this tool runs entirely in your browser, nothing you paste or select is uploaded, which makes it safe to inspect sensitive values without sending them to a third party.

Examples you can copy

Text:           Café ☕
Base64:         Q2Fmw6kg4piV

Text:           hello?
Standard:       aGVsbG8/
URL-safe:       aGVsbG8_

<img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNk+M9QDwADhgGAWjR9awAAAABJRU5ErkJggg==" alt="">

.icon { background-image: url("data:image/svg+xml;base64,PHN2Zy…"); }

Common mistakes to avoid

Frequently asked questions