What Base64 Actually Does
Base64 represents arbitrary bytes using only 64 safe ASCII characters (A–Z, a–z, 0–9, +, /, plus = for padding). Every 3 bytes of input become 4 output characters, so encoded data is about 33 % larger than the original. It exists so binary or special-character data can travel through channels that only handle plain text — email bodies, JSON strings, HTML attributes, HTTP headers.
Concrete example: Hello World encodes to SGVsbG8gV29ybGQ=. The trailing = is padding that marks the final 3-byte group as incomplete — decoders need it to know where the data ends.
Full UTF-8 Support
The browser's raw btoa() function chokes on anything outside Latin-1 — try encoding an emoji with it and you get a "characters outside of the Latin1 range" error. This tool converts your text to UTF-8 bytes first, so café, 日本語 and 🚀 encode and decode round-trip correctly. café becomes Y2Fmw6k= (5 bytes, because é takes two bytes in UTF-8), and decoding Y2Fmw6k= gives you café back exactly.
Common Uses
- Data URIs: embedding small images or fonts directly in CSS/HTML as
data:image/png;base64,…. - HTTP Basic Auth: the
Authorizationheader carriesuser:passwordBase64-encoded. - JWT tokens: each of the three dot-separated segments is Base64url-encoded JSON — decode one to inspect its claims.
- Binary in JSON/XML: file contents, keys, and certificates are routinely shipped as Base64 strings in APIs.
Base64 Is Not Encryption
This is the pitfall worth repeating: Base64 is an encoding, not encryption. There is no key — anyone can decode it instantly, as you can verify with this very tool. Never treat Base64 as a way to hide passwords or secrets. If you need integrity checks, use the hash generator; if you need a strong secret in the first place, use the password generator. And note that standard Base64 uses + and /, which are unsafe inside URLs — run encoded output through the URL encoder before putting it in a query string. Like all tools here, encoding and decoding run entirely in your browser; nothing is sent to a server.