Base64 Encode and Decode Online

Base64 turns arbitrary bytes into plain ASCII text. It takes the input 3 bytes (24 bits) at a time, splits them into four 6-bit groups, and maps each group (a number from 0 to 63) to one character of a 64-character alphabet: A–Z, a–z, 0–9, + and /. The encoding is defined in RFC 4648.

When the input is not a multiple of 3 bytes, the last group is filled with zero bits and = padding brings the output to a multiple of 4 characters. Text is converted to bytes first — almost always as UTF-8 — which is why café encodes to Y2Fmw6k=: the é is the two bytes C3 A9.

No. Base64 is an encoding: a reversible change of representation with no key and no secret. Anyone who sees dXNlcjpwYXNz can decode it to user:pass in a millisecond — which is exactly what an HTTP Basic Authorization header contains. Kubernetes Secrets, JWT payloads and many config files are Base64 too, and none of them are protected by it.

If data must stay private, encrypt it (for example AES-GCM via Web Crypto or libsodium) and then Base64-encode the ciphertext for transport. To fingerprint data, use the hash generator; to read a token's claims, use the JWT decoder.

Every 3 bytes become 4 characters, so the encoded size is 4 × ⌈n / 3⌉ — about 4/3 of the input, or +33%. Padding adds up to two characters, MIME line breaks add two more bytes (CRLF) per 76 characters, and a data URI adds its data:<type>;base64, prefix.

That overhead is why inlining is a trade-off. A data URI saves an HTTP request, but the bytes grow by a third, cannot be cached separately and are re-downloaded with every copy of the page or stylesheet that embeds them. Inline small icons and tiny fonts; serve photos and large files as normal files.

Standard Base64 uses + and /, which have special meanings in URLs and file paths. Base64url (RFC 4648 §5) swaps them for - and _ and usually drops the padding.

A classic bug: putting standard Base64 in a query string without escaping it. Form decoding turns each + into a space and the value breaks. Either use Base64url or URL-encode the value. Data URIs are the opposite case: browsers decode them with the standard alphabet only, so never use Base64url there. This decoder accepts both alphabets, with or without padding and line breaks.

Every language has a built-in. Modern browsers (Baseline since September 2025) convert bytes directly with Uint8Array.prototype.toBase64() and Uint8Array.fromBase64(), including the URL-safe alphabet. The one trap in older code is btoa(), which only accepts Latin-1 and throws on emoji or most non-English text, so convert to UTF-8 bytes first:

// JavaScript (modern browsers): bytes in, Base64 out
const bytes = new TextEncoder().encode("Hello, 世界");
bytes.toBase64();                                         // "SGVsbG8sIOS4lueVjA=="
bytes.toBase64({ alphabet: "base64url", omitPadding: true });
new TextDecoder().decode(Uint8Array.fromBase64("SGVsbG8sIOS4lueVjA=="));

// JavaScript (older browsers): UTF-8 safe btoa
const b64 = btoa(String.fromCharCode(...bytes));          // "SGVsbG8sIOS4lueVjA=="
const text = new TextDecoder().decode(Uint8Array.from(atob(b64), (c) => c.charCodeAt(0)));

// Node.js
Buffer.from("Hello, 世界").toString("base64");     // standard
Buffer.from("Hello, 世界").toString("base64url");  // URL-safe, no padding

# Python
import base64
base64.b64encode("Hello, 世界".encode()).decode()          # standard
base64.urlsafe_b64encode(b"\xfb\xff").decode()            # "-_8="

// Go
base64.StdEncoding.EncodeToString([]byte("Hello, 世界"))
base64.RawURLEncoding.EncodeToString(data) // URL-safe, no padding

// C#
Convert.ToBase64String(Encoding.UTF8.GetBytes("Hello, 世界"));
Encoding.UTF8.GetString(Convert.FromBase64String(b64));

On the command line, base64 file.png encodes (GNU base64 wraps at 76 columns; add -w 0 for one line) and base64 -d decodes. The spread-into-fromCharCode trick above is fine for short strings; for files, encode in chunks or use FileReader.readAsDataURL.