Encode text to Base64 and decode it back again.
Type or paste text to encode it.
Encoded and decoded in this tab — nothing is transmitted.
Converts text to Base64 and back. Base64 represents data using only 64 plain characters, which is how binary survives places that only accept text — email bodies, JSON fields, data URLs, HTTP headers.
The whole difficulty is Unicode, and it is where most online Base64 tools quietly fail. The browser's built-in encoder only accepts characters below 256, so a naive implementation throws on “café” and mangles an emoji. This encodes to UTF-8 bytes first, so accents, Chinese characters and emoji all survive the round trip intact.
Base64 is an encoding, not encryption. Anyone can decode it — this page does it in a keystroke. It hides nothing.
Kubernetes secrets, environment files and API responses are full of Base64. Decoding is usually the fastest way to see what you are actually dealing with.
A tiny icon as a data URL saves an HTTP request. Encoding is the first half of building one.
Values with newlines or unusual characters travel safely through headers and query strings once encoded.
URL-safe Base64 swaps two characters and drops the padding. This accepts both forms, so a token pasted from a URL decodes without editing.
Encode turns text into Base64; decode goes the other way. Switching direction feeds the current result back in, since that is almost always what you meant.
It converts as you type. Pasted Base64 can include line breaks and missing padding — both are handled.
That variant replaces + and / with - and _ and drops the trailing =, which is what you want inside a URL or filename.
One click. Nothing was sent anywhere to produce it.
No, and treating it as though it were is a genuine security mistake. It is a reversible encoding with no key — anyone can decode it instantly. Never use it to hide a password or a token.
Because the browser's btoa() only handles characters below 256 and throws on anything else, and the common workaround corrupts multi-byte characters. Encoding to UTF-8 bytes first is the correct fix, which is what happens here.
Base64 represents three bytes as four characters, so the result is about a third larger. That is the cost of making binary safe to put in text.
A variant that avoids + and /, which have their own meaning in URLs, and usually omits the = padding. JWTs use it. This tool decodes both variants without being told which.
This handles text. If a string decodes to binary rather than readable text the tool says so instead of showing you gibberish — that usually means you have an encoded image or document rather than an encoded message.