Base64 Encode & Decode Online — Free
Encode text to Base64 or decode Base64 strings back to text.
Frequently Asked Questions
How do I decode Base64 online?
Paste your Base64 encoded string into the input box and click Decode. The tool instantly converts it to readable text. No sign-up or installation needed.
What is Base64 encoding?
Base64 is a binary-to-text encoding scheme that represents binary data in an ASCII string format using 64 characters (A-Z, a-z, 0-9, +, /). It's commonly used for data URLs, email attachments, and API authentication.
Does this support Unicode and UTF-8?
Yes, full UTF-8 and Unicode characters are properly supported for both encoding and decoding, including emojis and international characters.
Is Base64 encryption?
No, Base64 is an encoding scheme, not encryption. It's easily reversible and should not be used for securing sensitive data. Use proper encryption for security.
Privacy First: All encoding/decoding happens in your browser. Your data never leaves your device.
About Base64
Base64 encodes arbitrary bytes using 64 printable ASCII characters so that binary data can travel through channels that only reliably carry text. It is an encoding, not encryption — anyone can decode it.
How the encoding works
Base64 processes input three bytes at a time. Twenty-four bits are regrouped into four six-bit values, and each of those indexes a 64-character alphabet. Four output characters for every three input bytes is where the well-known 33 percent size increase comes from.
When the input length is not a multiple of three, the final group is padded. That is why encoded strings so often end in one or two equals signs, and why a length that is not a multiple of four indicates truncation.
Base64 is not encryption
This is worth stating plainly because it is a recurring source of real security incidents. Base64 provides no confidentiality whatsoever — decoding requires no key and takes microseconds. Credentials, tokens and personal data encoded in Base64 are stored in plaintext for every practical purpose.
Its legitimate uses are transport concerns: embedding images as data URIs, attaching binary files to email under MIME, carrying binary payloads inside JSON, and HTTP Basic authentication headers — which is precisely why Basic auth requires TLS to be safe.
Standard Base64 versus the URL-safe variant
The plus and slash characters are unsafe in URLs and filenames: plus is decoded as a space in query strings, and slash is a path separator. The URL-safe variant defined in RFC 4648 substitutes hyphen and underscore respectively, and usually omits the padding.
This is the variant used in JWTs. A token segment pasted into a standard Base64 decoder may fail or produce corrupted output — decode it as URL-safe Base64, or use a dedicated JWT decoder that handles the substitution for you.