The problem Base64 solves

Many systems only transport text. Email was designed for 7-bit ASCII, JSON is defined as text, and HTML attributes hold strings. But the things we actually want to move around — images, PDFs, encryption keys, binary protocol buffers — are bytes that can easily include control characters, quotes, or newlines.

If you paste raw binary into a text channel, something will eventually eat a byte: a line ending gets rewritten, a quote terminates a string early, a proxy strips a NUL. Base64 gives you a safe envelope by re-encoding those bytes using only 64 characters that every text system agrees on:

A–Z  a–z  0–9  +  /

= is used only for padding at the end. That’s the entire alphabet.

How Base64 works

Base64 processes input in groups of 3 bytes (24 bits) and rewrites them as 4 characters (4 × 6 bits):

Input bytes Bits Base64 output
Man 24 bits TWFu
Ma 16 bits + padding TWE=
M 8 bits + padding TQ==

Two consequences follow directly from that design:

  1. Output is about 33% larger than the input (4 characters instead of 3 bytes).
  2. Padding tells the decoder what to ignore. One or two = at the end means the last group was short.

The encoding is fully reversible and completely public. There is no key and no secret.

Where you meet Base64 in practice

  • Data URIs — background-image: url(data:image/png;base64,iVBORw0KGgo...) embeds tiny images directly in CSS or HTML.
  • JSON APIs — sending a file, a thumbnail, or a cryptographic signature inside a JSON field.
  • Email attachments — MIME encodes attachments with Base64 so they survive text-only mail servers.
  • HTTP Basic auth — Authorization: Basic dXNlcjpwYXNz is just user:pass encoded.
  • JWTs — the header and payload segments of a JSON Web Token are Base64URL strings.

Base64 is not encryption

This is the single most important thing to understand: Base64 provides zero confidentiality.

Anyone who sees a Base64 string can decode it in one line — no key, no tooling beyond a browser console. Encoding is a transport concern; encryption is a security concern. If you need confidentiality, use TLS in transit and real encryption (AES-GCM, libsodium, age…) at rest, then Base64 the ciphertext if the transport requires text.

How to encode or decode Base64 in your browser

You don’t need to install anything. The Base64 encoder and decoder on this site runs entirely in your browser: nothing is uploaded, and it works offline.

  1. Pick Encode or Decode.
  2. Paste your text, or the Base64 string, into the input box.
  3. Press Convert (or Ctrl/⌘ + Enter).
  4. Copy or download the result.

Because the tool is a plain HTML file with no backend, it is safe for internal IDs, config fragments and log snippets — but still never paste production secrets into any online tool you don’t control.

Five pitfalls worth knowing

1. URL-safe Base64 uses a different alphabet. Standard Base64 has + and /, which are meaningful in URLs. The URL-safe variant (RFC 4648 §5) replaces them with - and _. If a decoder rejects a string that “looks fine”, check the alphabet first.

2. Padding is sometimes stripped. Many encoders remove trailing = to save space. Decoders must then infer the missing bytes. Most libraries handle this, but a strict one will throw.

3. Whitespace and line breaks. Classic MIME output wraps lines at 76 characters. Most decoders ignore \n and spaces — ours does — but you should not assume every decoder will.

4. btoa() is not UTF-8 aware. In the browser, btoa('中文') throws an InvalidCharacterError, because btoa only accepts Latin-1. The fix is to convert the string to UTF-8 bytes first (TextEncoder) and only then encode. Good tools do this for you — ours does.

5. Double encoding. Encoding a string that is already Base64 produces a second layer that looks valid but means nothing. If your decoded output is still gibberish, you probably encoded twice — or you encoded binary data that isn’t text at all.

FAQ

How much bigger does Base64 make my data? About 33% before compression. A 1 MB image becomes roughly 1.37 MB of text.

Can I decode Base64 by hand? In principle yes — it’s a 6-bit mapping table. In practice, use a decoder and save the afternoon.

Does Base64 compress data? No. It expands it. If you want smaller payloads, compress first (gzip, Brotli, zstd), then encode.

Is it safe to put Base64 in a URL? Only the URL-safe alphabet. Otherwise you should percent-encode the result — our URL encoder does exactly that.

Try it

If you are the kind of person who accumulates a hundred useful links a month, you may also like NavShelf — a file-manager style bookmark manager where everything stays in your browser.