What this tool does
This free Base64 tool converts text to Base64 and decodes Base64 back to text. Everything runs entirely in your browser using the native btoa and atob functions with full UTF-8 support — nothing is uploaded to any server, so it is safe for sensitive text.
When you would use it
- Embedding a small image or file inside JSON or a data URI.
- Reading a Base64 value from an API response or a JWT payload.
- Decoding a Basic Auth header to check its contents.
Base64 is an encoding, not encryption — anyone can decode it. Never use it to protect passwords or secrets. Learn more in our guide: Base64 Encoding Explained.
How Base64 encoding works
Base64 takes binary data and re-expresses it using only 64 characters that survive any text-based channel: A–Z, a–z, 0–9, plus + and /. It works by reading your input three bytes at a time (24 bits), splitting those 24 bits into four 6-bit groups, and mapping each group to one character from the 64-character alphabet.
Three bytes in, four characters out — which is exactly why Base64 output is about 33% larger than the original data. When the input length is not divisible by three, the encoder pads the result with = characters so the output length stays a multiple of four. That trailing = you often see is padding, not part of the data.
Why the format exists
Many protocols were designed for text and mishandle raw binary. Email (SMTP) historically stripped or corrupted certain byte values; JSON has no binary type at all; URLs only permit a limited character set. Base64 solves this by guaranteeing that whatever you encode arrives intact, because every character in the output is one that these systems already handle safely.
Where you will actually encounter it
- Data URIs: small images embedded directly in HTML or CSS as
data:image/png;base64,..., removing a separate network request. - JSON payloads: sending a file through an API that only accepts text fields.
- Email attachments: MIME encodes attachments in Base64 under the hood.
- JWT tokens: the header and payload segments are Base64url-encoded, which is why you can decode and read them.
- Basic authentication: credentials are Base64-encoded in the Authorization header — encoded, not protected.
UTF-8 and why naive encoding breaks
The browser's built-in btoa function only handles characters in the Latin-1 range, so passing it an emoji or a Georgian, Cyrillic, or Chinese character throws an error. This tool encodes your text as UTF-8 first and then applies Base64, which is why it handles every language and emoji correctly. Decoding reverses both steps.
The security misunderstanding worth repeating
Because Base64 output looks scrambled, it is regularly mistaken for a form of protection. It is not. There is no key and no secret — anyone can decode it instantly, including with this page. Base64 is an encoding, which changes representation; encryption changes meaning and requires a key. Never use Base64 to store passwords, hide API keys, or protect anything sensitive. If you need confidentiality, you need encryption.
When not to use it
The 33% size overhead matters at scale. Embedding large images as data URIs bloats your HTML or CSS, and unlike a normal image file, embedded data cannot be cached separately by the browser — every page load re-downloads it. For anything beyond small icons, a regular file URL is faster. Similarly, stuffing large files into JSON as Base64 strings inflates payloads and memory use on both ends; a direct binary upload is usually the better design.
Frequently Asked Questions
Is my text uploaded anywhere?
No. Encoding and decoding happen locally in your browser. Your input never leaves your device.
Does it support emoji and other languages?
Yes — this tool encodes text as UTF-8 first, so emoji and non-English characters work correctly.
Why do I get an error when decoding?
Decoding fails if the input is not valid Base64 (for example, if it contains spaces or is truncated). Check that you pasted the complete, unmodified Base64 string.