Base64 Encoder and Decoder

What is Base64 and why does it exist?

Many systems that move data around were built to handle plain text, not arbitrary bytes. Early email, for example, was designed for readable characters, so sending an image or a PDF directly would corrupt it along the way. Base64 is the workaround: a method of representing any binary data using only 64 safe, printable characters. The data becomes longer, but it can travel through text based channels without being mangled.

You meet Base64 more often than you might expect. It appears in email attachments, in images embedded straight into web pages, in authorisation headers, in tokens, and in configuration files. This guide explains how the encoding really works, walks through a verified example by hand, shows where it is used, and clears up the most dangerous misunderstanding about it: Base64 is not encryption.

How does Base64 work?

The idea is simple. Computers store data as bytes, and each byte is 8 bits. Base64 takes the input three bytes at a time, which is 24 bits, and regroups those bits into four chunks of 6 bits each. A 6 bit chunk can hold a value from 0 to 63, which is why there are 64 possible symbols. Each value is then mapped to a character from the Base64 alphabet:

• Values 0 to 25 map to uppercase A to Z.
• Values 26 to 51 map to lowercase a to z.
• Values 52 to 61 map to the digits 0 to 9.
• Value 62 maps to the plus sign, and value 63 maps to the forward slash.

So three input bytes become four output characters. That is why Base64 output is roughly one third larger than the original data.

What is padding and why do you see equals signs?

Real data rarely has a length that is an exact multiple of three. When the final group has only one or two bytes, the encoder pads it. If two bytes remain, the output ends with one equals sign. If one byte remains, it ends with two equals signs. The equals sign is not part of the alphabet. It only signals how many bytes the last group really contained, so a decoder can restore the exact original length. When the input length is a multiple of three, there is no padding at all.

Can you walk through a real example by hand?

Take the word Hello. Its ASCII byte values are H = 72, e = 101, l = 108, l = 108, o = 111. In binary these are 01001000, 01100101, 01101100, 01101100 and 01101111.

First group: "Hel". Joining the bits gives 010010000110010101101100. Splitting into four 6 bit chunks gives 010010, 000110, 010101 and 101100, which are 18, 6, 21 and 44. In the alphabet, 18 is S, 6 is G, 21 is V and 44 is s. So "Hel" encodes to SGVs.

Second group: "lo". Only two bytes remain: 01101100 and 01101111. Joining gives 0110110001101111, which is 16 bits. Pad with two zero bits to reach 18 bits, then split into three 6 bit chunks: 011011, 000110 and 111100, which are 27, 6 and 60. Those map to b, G and 8. Since one byte was missing, one equals sign is added, giving bG8=.

Putting it together, Hello encodes to SGVsbG8=. Decoding simply reverses each step.

How do you use the encoder and decoder?

1. Type or paste your plain text, or the Base64 string you want to decode, into the input.
2. Choose Encode to produce Base64, or Decode to turn Base64 back into text.
3. Press Convert, then copy the result from the output.

If decoding fails, the input probably contains characters outside the Base64 alphabet, has been cut off, or has had its padding or line breaks altered.

How does the tool handle Unicode and non-English text?

Base64 works on bytes, not letters, so text must first be turned into bytes. For plain English letters that is trivial, but characters such as é, the euro sign or emoji take more than one byte. This tool converts text to bytes using UTF-8, the dominant encoding on the web, before encoding, and reverses it when decoding. That means accented letters and symbols round trip correctly. For example, the word "café" is encoded from its UTF-8 bytes, where é occupies two bytes, rather than from a single byte value. If you decode a string that was originally produced from a different text encoding, the result may display incorrectly because the tool interprets the bytes as UTF-8.

Where is Base64 used in everyday work?

Data URIs

Small images, icons or fonts can be embedded directly in HTML or CSS using a data URI, which has the form data:image/png;base64, followed by the encoded content. This saves a separate network request, though it makes the file larger and is best kept for tiny assets.

Email attachments

The email standard known as MIME uses Base64 to carry attachments inside what is fundamentally a text message. If you have ever viewed the raw source of an email, the long blocks of seemingly random letters are usually an encoded attachment.

HTTP Basic authentication

Basic authentication sends a header containing the word Basic followed by the Base64 form of username:password. For instance, user:pass encodes to dXNlcjpwYXNz. This is only formatting. Anyone who sees the header can decode it instantly, which is why Basic authentication should only be used over an encrypted HTTPS connection.

JSON Web Tokens

A JWT consists of three segments separated by dots. Each segment uses a variant called base64url, which swaps the plus sign for a hyphen and the slash for an underscore, and usually omits the padding. The swaps exist because plus, slash and equals have special meanings inside URLs. This tool uses the standard alphabet, so a base64url string may need those characters converted back, and padding added, before it decodes cleanly.

Is Base64 a form of encryption?

No, and this is the point worth remembering. Encryption requires a secret key, and without it the data is unreadable. Base64 has no key and no secret. Anyone can decode it in a second, as the tool above demonstrates. It is an encoding, a reversible change of format, not a security measure. Never store passwords, API keys or private information as Base64 and think of them as protected. If you need confidentiality, use proper encryption. If you need to store passwords, use a dedicated password hashing method. A strong, random password is a better starting point than any encoding trick, and our Password Generator can create one.

What tips and common mistakes should you know about?

• Treating it as security. The most serious mistake. Base64 hides nothing.
• Forgetting the size increase. Encoded data is about a third larger, which matters for large files.
• Mixing up variants. Standard Base64 and base64url use different characters for values 62 and 63.
• Trimming padding by accident. Some systems require the equals signs, others omit them. Check what yours expects.
• Decoding binary as text. If you decode an encoded image, the result is bytes, not readable words, and will look like garbage in a text box.

Who finds this tool useful?

Developers use it to inspect headers, tokens and encoded configuration values. Web designers use it to understand or craft data URIs. Students studying networking or computer science use it to see how binary to text conversion works. Support staff and technical writers use it to read encoded snippets from logs.

Is it private?

Yes. Encoding and decoding happen locally in your browser. The text you enter is not uploaded, logged or sent to any server. That said, because Base64 is trivially reversible, treat any encoded secret as exposed the moment it is displayed or shared.

What are the limitations?

The tool is designed for text. It does not accept file uploads, so it cannot convert an image or document into Base64. It uses the standard alphabet rather than offering a dedicated base64url mode. Decoded output is interpreted as UTF-8 text, so binary data or text in another encoding may appear corrupted.

Frequently asked questions

What does Base64 of "Hello" look like?

The text "Hello" encodes to SGVsbG8=. The single equals sign is padding because the final group of bytes was incomplete.

Why does Base64 output end with equals signs?

The equals signs pad the last group so the output length is a multiple of four characters. One equals sign means two bytes remained, and two mean only one byte remained.

Is Base64 secure?

No. It is not encryption and offers no confidentiality. Anyone can decode it without a key.

Why is Base64 data larger than the original?

Every three bytes become four characters, so the output is about 33 percent larger, plus a little extra for padding.

What is the difference between Base64 and base64url?

Base64url replaces the plus sign with a hyphen and the slash with an underscore, and often drops padding. It is used where the data must be safe inside URLs, as in JSON Web Tokens.

Can I encode emoji and accented characters?

Yes. The text is converted to UTF-8 bytes first, so accented letters, symbols and emoji encode and decode correctly.

Why does decoding give me an error?

The string likely contains characters outside the alphabet, is missing part of its content, or has damaged padding. Remove stray spaces and check that you copied the whole string.

Final thoughts

Base64 is a practical bridge between binary data and text, nothing more and nothing less. Understanding the three bytes to four characters rule makes the strings you meet in headers, emails and tokens far less mysterious. For related jobs, try the JSON Formatter to inspect decoded payloads, the QR Code Generator to share encoded text, and the Case Converter. You will find many more in our collection of free tools.