About Base64 Encoding
Base64 is a way of representing arbitrary binary data using only 64 printable ASCII characters: A–Z, a–z, 0–9, plus the symbols + and /, with = used as padding at the end. It exists because many systems — email, URLs, JSON strings, HTTP headers — were designed to carry text, and stuffing raw bytes through them tends to corrupt the data. Encoding to Base64 adds about 33% size overhead, but guarantees the payload survives the trip.
You will most often see Base64 in three places: the Authorization header of HTTP requests (Basic and Bearer token schemes), data URLs embedded in HTML or CSS (data:image/png;base64,…), and email attachments (MIME bodies). It is also used by configuration systems such as Kubernetes Secrets, which require all values to be Base64-encoded even though the contents are not secret in any meaningful way.
A common misconception is that Base64 offers any kind of security. It does not. Anyone who sees an encoded string can decode it instantly — and this tool proves it. Use Base64 for transport safety; use real encryption when you need secrecy.
How to Encode and Decode Base64
- Type or paste text into the input field — anything from a single word to a multi-paragraph block.
- Choose the direction: encode turns plain text into Base64, decode does the reverse.
- The result appears in the output area immediately. Copy it with the copy button or continue editing the input to see the result update.
- If you are decoding and the output looks like garbage, the input was probably not valid Base64, or was encoded from binary data that is not plain text.
Examples
Encoding plain text
Input
Hello, world!
Output
SGVsbG8sIHdvcmxkIQ==
Decoding an HTTP Basic auth header
Input
dXNlcjpwYXNzd29yZA==
Output
user:password
Basic authentication is literally the string username:password run through Base64. It is not encryption — always use HTTPS.
Why padding matters
Input
SGk=
Output
Hi
The trailing = is padding added when the input byte count is not a multiple of 3. Decoders need it to know where the data ends.
Common Use Cases
- Inspecting an Authorization: Basic … header to see which username was sent.
- Creating a data: URL to inline a small image directly into HTML or CSS without a separate request.
- Reading or writing Kubernetes Secret values, which are stored Base64-encoded by design.
- Pasting a JWT to split it into its three parts (header, payload, signature) — each part is Base64-URL-encoded.
- Embedding binary data inside a JSON payload, which cannot hold raw bytes natively.
Tips
- Base64 and Base64-URL are slightly different. The URL-safe variant replaces + with - and / with _ so the result can live in a URL without percent-encoding. Some decoders handle both; some do not.
- The trailing = characters are padding and can sometimes be safely omitted, but many strict decoders will reject a string that is missing them.
- If you decode something and see non-printable characters, the source was binary (an image, a certificate, a compressed blob). Treat the output as bytes, not text.
Frequently Asked Questions
Is Base64 encryption?
No. Base64 is an encoding, not encryption. It is fully reversible without any key. Treat encoded strings as effectively plaintext — anyone can decode them in one step.
Why does my encoded string end with one or two equals signs?
That is padding. Base64 groups input bytes in threes and emits four output characters per group. If the last group has only one or two bytes, = is appended so the output length is still a multiple of four.
Can I encode any file with this tool?
This tool handles text. For binary files such as images or PDFs, you typically want a command-line tool (base64 on macOS and Linux, certutil -encode on Windows) that reads the raw bytes. Pasting binary into a text field usually corrupts it.
What is the difference between Base64 and Base64-URL?
Base64-URL is a variant that uses - and _ instead of + and /, and usually omits padding. It exists because + and / have special meaning in URLs and would otherwise need percent-encoding. JSON Web Tokens (JWTs) use the URL-safe variant.
Is my input sent to a server?
No. Encoding and decoding happen entirely in your browser.