Base64 turns bytes into text made of 64 printable characters: A-Z, a-z, 0-9, + and /, with = as padding at the end. Every 3 bytes become 4 characters, so “Man” becomes “TWFu” and the result is about 33% larger than the original.
Base64 is not encryption and not compression. Anyone can decode it, and it always makes data bigger.
Why Base64 exists
Many systems were built to carry text, not arbitrary bytes. Base64 lets binary data pass through them intact: email attachments (MIME), files inside JSON or XML payloads, data URIs in HTML and CSS, the Authorization header of HTTP basic authentication, and the three parts of a JSON Web Token.
URL-safe Base64 and padding
The + and / characters mean something in URLs and file names, so the URL-safe variant (RFC 4648, section 5) uses - and _ instead. “??>>” is “Pz8+Pg==” in standard Base64 and “Pz8-Pg” in URL-safe Base64 without padding.
Padding fills the last group of 4: one leftover byte gives two = signs (“M” is “TQ==”), two give one (“Ma” is “TWE=”). Many URL-safe formats, such as JWTs, drop it. When decoding, this tool accepts both alphabets and missing padding, and tells you which variant it found.
Base64 is not a secret
An HTTP basic auth header containing “dXNlcjpwYXNz” looks scrambled, but it decodes to “user:pass” in a second. Never treat Base64 as protection: use proper encryption for data, and a password hashing algorithm for stored passwords.
How to use
- Text: choose Encode or Decode, then type or paste. The result updates as you type; Swap sends it back and switches the mode.
- Options: URL-safe characters, no padding, or MIME lines of 76 characters when encoding; strict checking when decoding.
- File: choose a file of up to 5 MB to get its Base64 or a data URI, or paste Base64 or a data URI to download it as a file.
Features
- Exact UTF-8 for any language and emoji, through the browser's TextEncoder and TextDecoder.
- Errors that show the bad character and its position, impossible lengths and wrong padding; your input is never changed.
- Bytes that aren't text can be shown as hex or downloaded as a file.
- File type detection from the first bytes (PNG, JPEG, GIF, PDF, ZIP) and a preview for images; nothing decoded is ever run or rendered as HTML.
Common uses
- Debugging API payloads and JWTs. Decode Base64 fields in API responses, or the header and payload of a JSON Web Token, to read them.
- Data URIs for small images. Turn an icon into a data URI for CSS or HTML, or get the image back out of one.
- Email source. Read the MIME parts and attachments in the raw source of an email.
- Config values. Decode Base64 settings such as Kubernetes Secret data, or encode a value before you paste it in.
- Preparing test data for QA. Produce encoded fixtures with emoji, padding edge cases and invalid input to test how an app copes.
Frequently asked questions
What is Base64?
A way to write any bytes as text using 64 safe characters, defined in RFC 4648. It is used wherever binary data has to pass through a channel made for text.
Is Base64 encryption?
No. There is no key, and anyone can decode Base64 instantly, so it hides nothing. It only changes how data is written.
Why does Base64 end with = signs?
They are padding. Base64 works on groups of 3 bytes; when the data runs out early, one or two = signs complete the last group of 4 characters.
What is the difference between Base64 and Base64URL?
Base64URL replaces + with - and / with _, so the result is safe in URLs and file names, and it often leaves out the padding.
Why does my decoded text look like garbage?
Either the data isn't text, such as an image or a zip file, or the text uses a character set other than UTF-8. This tool tells you when the bytes aren't UTF-8 and lets you view them as hex or download them.
How much larger does Base64 make data?
About one third: every 3 bytes become 4 characters, so 300 bytes become 400 characters. MIME line breaks add a little more.
How do I use Base64 in JavaScript, Python and the command line?
In a browser, btoa("hello") gives aGVsbG8=, but btoa only accepts Latin-1 text. Node.js: Buffer.from("hello").toString("base64"). Python: base64.b64encode(b"hello").decode(). Command line: echo -n hello | base64, and base64 -d to decode.
Is my data uploaded?
No. Text and files are converted in your browser and never leave it, and nothing you enter is saved. Like the rest of the site, the page records a visit when it loads, but not your input.
Need to test a whole website, not just a snippet?
RoboQA tests real pages and user journeys in a browser: logins, forms, clicks and full flows. See what RoboQA can test or compare plans.