Is Base64 a form of encryption?

No, and treating it as one is a common security mistake. There is no key — the mapping is public and fixed, so anyone holding the string can recover the original bytes. Use it to move data through text-only channels, never to conceal it.

Why does my Base64 string end in one or two equals signs?

Padding. The encoder consumes 3 bytes at a time; when the input length leaves a remainder of 1 or 2 bytes, = characters fill the final group so the total length stays a multiple of four. A remainder of 1 produces ==, a remainder of 2 produces =.

What is base64url, and can I use it here?

It is the URL-safe variant in RFC 4648 §5, which swaps + for - and / for _ so the value survives inside a URL or filename. This tool emits standard Base64 only. To decode a base64url string, replace - with + and _ with / first.

Can I encode an image or PDF?

Not here — this page takes text. Encoding a binary file needs a file reader, which this tool deliberately does not include. For a one-off you can use base64 on macOS and Linux, or certutil -encode on Windows.

Why can valid-looking Base64 still fail to decode as text?

Base64 can represent any bytes, not only UTF-8 text. A value may use the standard alphabet and padding correctly yet decode to an image, compressed data, or text in another character encoding. This page expects the recovered bytes to be UTF-8, so those inputs can fail or look incorrect.

Does this tool add a data URI prefix or wrap long output lines?

No. It returns the standard Base64 characters only, without a data: prefix, MIME metadata, or fixed-width line wrapping. Add those separately only when the destination format explicitly requires them.

Base64 Encoder and Decoder Online

Overview

Standard Base64 for UTF-8 text, with the transport limits visible

Encode Unicode text into the standard A–Z, a–z, 0–9, +, / alphabet or decode it back. The output updates locally, reports malformed input, and can be swapped into the other direction without presenting Base64 as encryption.

UTF-8 round trips

Accents, emoji, and non-Latin scripts are converted to bytes before standard Base64 encoding.

Encode and decode

A two-state control selects the direction; Swap moves a valid result into the other side.

Malformed input is reported

Invalid alphabet, padding, or byte sequences produce an error instead of a plausible-looking result.

Text copy or download

Save encoded-base64.txt or decoded-text.txt after reviewing the live output.

How it works

Using Base64 Encoder / Decoder, start to finish

Three steps, in the order the tool above actually takes them.

1
Choose the direction
Use Encode for plain text or Decode for a standard Base64 string.
2
Paste text
The page handles text only; binary files and base64url are outside this control.
3
Check and keep the result
Resolve any decode error, then copy, download, or Swap for a quick round-trip check.

Use cases

What people bring here

The jobs this page is usually opened for, and the setting that makes each one quick.

A text field in a transport envelope

Encode Unicode text when a text-only channel expects standard Base64.

Confirm the receiving system expects standard Base64 rather than base64url or MIME-wrapped output.

Inspecting an encoded configuration value

Decode a non-sensitive value to confirm the bytes it represents.

Readable output proves encoding only; it does not establish who created the value.

A UTF-8 round-trip test

Check that a pipeline preserves accents, emoji, and scripts outside ASCII.

Encode, Swap, and compare the decoded result with the exact original text.

Representation is not protection

Base64 changes the alphabet, not who can read the data

There is no key and no access control. Its job is to represent bytes in text-safe characters, so security decisions must happen elsewhere.

Property	Common mistake	Accurate interpretation
Readable payload	The unfamiliar string conceals a secret.	Anyone can decode standard Base64 with the same public mapping.
Padding	Equals signs are encryption metadata.	They complete a four-character group when the final byte group is short.
base64url	Standard Base64 is always safe in a URL segment.	The URL-safe variant substitutes - and _ and commonly omits padding; this page emits the standard alphabet.
Size	Encoding compresses text.	Four output characters represent each three-byte group, so the representation normally grows.

Readable payload

The unfamiliar string conceals a secret.

Anyone can decode standard Base64 with the same public mapping.

Padding

Equals signs are encryption metadata.

They complete a four-character group when the final byte group is short.

base64url

Standard Base64 is always safe in a URL segment.

The URL-safe variant substitutes - and _ and commonly omits padding; this page emits the standard alphabet.

Size

Encoding compresses text.

Four output characters represent each three-byte group, so the representation normally grows.

Privacy

Where your work is processed

Plain text and encoded text stay in this tab. They are neither uploaded nor autosaved; clipboard and text download actions happen only when selected.

Source content stays in the tab

Encoding, parsing, formatting, generation, comparison, and cryptographic operations run in browser code. Form values and uploaded text files are not sent to a processing API.

Inputs are not autosaved

Code, tokens, secrets, URLs, and generated outputs stay in component memory until the page reloads or closes. Split-pane tools remember only the divider percentage for the current tab session.

Clipboard and downloads are explicit

The page reads the clipboard only after a Paste action and writes it only after Copy. A local download is created only when you choose the tool's download control.

One aggregate page view may be counted

The page shell can send the tool slug, never the editor contents or filename. The endpoint is rate-limited using a transient requesting address and is skipped for Do Not Track or Global Privacy Control.

More detail in how processing works and our privacy policy.

Limits

The exact Base64 surface

The values this tool actually enforces, not a rounded-up version.

Input: Text only; No binary file reader is included.
Character encoding: UTF-8; Unicode text is converted before btoa or after atob.
Alphabet: Standard Base64; + and / are used; base64url is not offered.
Persistence: None; Input and result remain in memory; divider position alone may persist for the session.

No files, base64url mode, encryption, or PEM wrapping

This tool works on text, not file uploads — there is no way to hand it a binary and get its Base64. It emits the standard alphabet only, not the URL-safe base64url variant from RFC 4648 §5, and it does not wrap output at a fixed column width the way PEM does.

FAQ

Base64 encoding questions

The ones that actually come up.

Developer tools

Choose a neighboring tool for the next step; each page states its processing and limits up front.

URL Encoder / DecoderPercent-encode one URL component with encodeURIComponent, or decode it back.Open JSON FormatterA full JSON workspace for formatting, repair review, queries, conversion, and comparison.Open JSON Repair ProA repair review for malformed and AI-generated JSON, with a named rule behind every change.Open JSON to TypeScriptInfer TypeScript interfaces from one JSON example, with sampling limits stated.Open CSV to JSON ConverterA full data workspace for parsing, mapping, inspecting, cleaning, and converting tabular data.Open SQL FormatterLay out a query with two-space indentation and dialect-aware keyword handling.Open

Guides

Reading that goes deeper

Password Best Practices: Length, Passphrases, Managers and 2FAWhy length beats complexity, how passphrases work, and a realistic system for managing passwords without losing your mind.Read JSON Web Tokens (JWT): How They Work and How to Use Them SafelyA beginner-friendly guide to JSON Web Tokens: what a JWT contains, how signing works, common use cases, and the security practices that keep tokens safe.Read