Base64 Encoder / Decoder

How Base64 Actually Works - A Worked Example

Base64 takes every 3 bytes of input and re-slices them into 4 groups of 6 bits, then maps each group to one of 64 characters (A–Z, a–z, 0–9, +, /). Watch Hi! become SGkh:

Text	H		i		!
Bytes	`01001000`		`01101001`		`00100001`
6-bit groups	`010010`	`000110`	`100100`	`100001`
Base64	S	G	k	h

When the input isn't a multiple of 3 bytes, = padding fills the gap - that's why Base64 strings end in = or == so often. It's arithmetic, not secrecy - Which is why anything sensitive needs real encryption before encoding.

Where You'll Meet Base64 in the Wild

JWT tokens

Every JSON Web Token is three URL-safe Base64 segments joined by dots: header.payload.signature. Decode the first two right here to inspect a token's claims - No library needed. (The signature only verifies with the key.)

Data URIs

data:image/png;base64,iVBOR… embeds an image directly in HTML or CSS - no extra request. Great for tiny icons; wasteful past a few KB because of the 33% size overhead.

Email attachments

SMTP was built for 7-bit text, so every attachment you've ever sent traveled as MIME Base64 - Wrapped at 76 characters per line, which is why decoding pasted email source sometimes needs whitespace stripped first.

Basic auth & API keys

The HTTP Authorization: Basic header is just user:password Base64-encoded - A favorite exam question because it looks encrypted and isn't. Anyone sniffing plain HTTP reads it instantly.

What Base64 Is (and Isn't)

Encoding, not encryption

Base64 turns binary data into 64 safe ASCII characters so it can travel through text-only channels - Email attachments, JSON payloads, data URIs, JWT segments. Anyone can decode it instantly; it hides nothing.

If you need confidentiality, use real encryption like AES-256 (here's how AES-256 actually works). If you need integrity fingerprints, use SHA-256 hashes. And never "protect" a password by Base64-encoding it - Generate a proper one with the password generator.

Details that bite

Standard Base64 uses + and /, which break URLs - The URL-safe variant swaps in - and _ (used by JWTs).
Base64 grows data by ~33%.
This tool is UTF-8 aware, so emoji and accented characters round-trip correctly.
Padding = is optional in many decoders but required by strict ones.

How to Use the Base64 Encoder / Decoder

1

Choose encode or decode

The labels flip automatically so you always know which direction you're converting.

2

Toggle URL-safe when needed

JWTs, query strings and filenames need - and _ instead of + and /.

3

Copy the result

Decoding is UTF-8 aware, so emoji and accented text round-trip exactly.

Base64 variants

Variant	Characters 62–63	Padding	Where you see it
Standard (RFC 4648)	+ /	= required	Email attachments, data URIs, certificates
URL-safe	- _	usually stripped	JWT tokens, URL parameters, filenames
MIME	+ / with line breaks	= required	Email bodies (76-char lines)

Base64 Encoder / Decoder - FAQ

Is Base64 encryption?

No - It's a reversible encoding anyone can decode instantly, with no key involved. It exists so binary data can travel through text-only channels. For secrecy you need real encryption like AES-256.

Why does Base64 make data bigger?

It represents every 3 bytes as 4 characters, a fixed 33% overhead (plus padding). That's the price of using only 64 safe ASCII characters.

Why do I sometimes see Base64 without = at the end?

The padding is mathematically redundant, so URL-safe contexts like JWTs strip it. This decoder adds missing padding back automatically.

Can I decode a JWT with this tool?

Yes - Paste the first or second dot-separated segment of the token with URL-safe mode on, and you'll see the JSON header or payload. You cannot verify the signature here; that requires the signing key on a server.

Does Base64 compress data?

The opposite: it inflates data by about 33%, because it spends 8-bit characters to carry 6 bits each. If size matters, compress first (gzip), then encode the compressed bytes.

More questions about passwords and security? Browse the security guides.

More Free Tools

Password Generator →