Encode and decode Base64 text
Convert text to Base64, or decode a Base64 string back to readable text. Text in any language works, emoji included, because it is converted to UTF-8 bytes before encoding. Everything runs in your browser.
What Base64 is for
Base64 writes binary data using 64 characters that survive any system built for plain text: A to Z, a to z, 0 to 9, + and /, with one or two = signs as padding at the end. You meet it in email attachments, in data URLs that embed small images in HTML or CSS, in HTTP Basic authentication headers, and in API fields that cannot hold raw bytes.
Every 3 bytes of input become 4 characters, so encoded data is about a third larger than the original. That is the price of being able to paste binary data into a text field.
Base64 is not encryption
Anyone can decode Base64 in a second, on this page or with one line of code. Never use it to hide a password or an API key. A header such as Authorization: Basic dXNlcjpwYXNz contains the username and password in plain sight: decoded, it reads user:pass. The only thing protecting it is the HTTPS connection it travels over.
Variants you will run into
- Standard Base64 uses + and / and pads with =. This is what the tool reads and writes.
- Base64URL, used in JSON Web Tokens and in many URLs, swaps + for - and / for _ and usually drops the padding. To decode it here, change every - back to + and every _ back to /.
- Data URLs begin with a label such as data:image/png;base64, which is not part of the encoded data. Remove everything up to and including the comma before decoding.
Reading a JWT
A JSON Web Token is three Base64URL parts separated by dots. The first two are JSON: a header describing the algorithm, and the payload with the claims, such as the user ID and expiry time. Convert the - and _ characters as described above, decode either part, and you can read it. The third part is a binary signature and will not decode to text. Decoding a token does not verify it, and anyone holding a valid token can use it, so treat tokens like passwords.
When decoding fails
The decoder ignores spaces and line breaks, which emails and PDFs often add, and it copes with missing = padding. It reports an error for characters outside the Base64 alphabet, and for data that is not text. This page decodes to readable text only, so Base64 that holds an image, a PDF or another file cannot be shown here.