Free Base64 encoder / decoder
Encode text to a Base64 string or decode Base64 back to text — standard RFC 4648 alphabet, full UTF-8 support, with the result updated live, as you type.
On this page15 sections
Output is generated client-side in your browser. No data is transmitted to any server.
Results are estimates. Consult a professional.
What is Base64 encoding?
Base64 is a way to write any data — text, an image, a key, a whole file — using only 64 printable characters that survive plain-text channels untouched. It maps every three bytes of input to four characters drawn from a fixed alphabet of A–Z, a–z, 0–9, plus the two symbols + and /. Because those characters pass cleanly through email, URLs, JSON, and HTTP headers, Base64 lets you carry binary data over systems that were only ever built for text.
The tool above runs the conversion live as you type. Paste text into the encode field and it returns the Base64 string; paste a Base64 string into the decode field and it returns the original text back. Nothing leaves your browser, so it is safe to use on values you would not want to send to a server.
Why Base64 exists: moving binary through text-only channels
Many of the systems data travels through were designed for text, not arbitrary bytes. Email was historically limited to 7-bit ASCII; URLs reserve characters like ? and & for their own meaning; HTTP headers and JSON values cannot hold raw control bytes or null characters without breaking. Send raw binary through any of these and a stray byte gets stripped, reinterpreted, or corrupts the message.
Base64 solves this by re-expressing the bytes using only characters every one of those channels treats as ordinary text. The data is unchanged in meaning — it is just dressed in a safe alphabet for the trip, then decoded back to the exact original bytes at the other end. That is why Base64 underpins email attachments, inline images, and tokens passed in headers.
How Base64 encoding works: 3 bytes to 4 characters
The mechanism is pure arithmetic on bits. Three bytes are 24 bits. Base64 re-slices those same 24 bits into four groups of 6 bits each. Each 6-bit group is a number from 0 to 63, and that number is the index into the 64-character alphabet. So three input bytes always become four output characters, and the output is made entirely of the safe alphabet.
The = padding is bookkeeping, not data. It exists only so the encoded length is always a multiple of four, which lets a decoder know exactly how many real bytes the final group held: one = means the last group was two bytes, two == means it was one byte. Because four characters encode three bytes, the output is roughly 33% larger than the input — four characters of cost for every three bytes of data.
The Base64 alphabet table
Every 6-bit group becomes one of these 64 characters. The index is the value of the 6 bits (0–63); the character is what the encoder writes for that value. This is the standard alphabet from RFC 4648 — the URL-safe variant is identical except for the last two rows.
| Index | Char | Index | Char | Index | Char | Index | Char |
|---|---|---|---|---|---|---|---|
| 0 | A | 16 | Q | 32 | g | 48 | w |
| 1 | B | 17 | R | 33 | h | 49 | x |
| 2 | C | 18 | S | 34 | i | 50 | y |
| 3 | D | 19 | T | 35 | j | 51 | z |
| 4 | E | 20 | U | 36 | k | 52 | 0 |
| 5 | F | 21 | V | 37 | l | 53 | 1 |
| 6 | G | 22 | W | 38 | m | 54 | 2 |
| 7 | H | 23 | X | 39 | n | 55 | 3 |
| 8 | I | 24 | Y | 40 | o | 56 | 4 |
| 9 | J | 25 | Z | 41 | p | 57 | 5 |
| 10 | K | 26 | a | 42 | q | 58 | 6 |
| 11 | L | 27 | b | 43 | r | 59 | 7 |
| 12 | M | 28 | c | 44 | s | 60 | 8 |
| 13 | N | 29 | d | 45 | t | 61 | 9 |
| 14 | O | 30 | e | 46 | u | 62 | + |
| 15 | P | 31 | f | 47 | v | 63 | / |
Standard Base64 alphabet per RFC 4648 §4. The pad character "=" sits outside the alphabet and only marks the end. The URL-safe alphabet (§5) replaces index 62 "+" with "-" and index 63 "/" with "_".
How to encode and decode with this tool
Encoding and decoding are exact mirror images, so the tool runs in both directions. To encode, type or paste plain text and read the Base64 string out. To decode, paste a Base64 string and read the original text out. The conversion updates the moment you change the input.
- Encode — text or bytes go in, a Base64 string comes out. The output uses only the safe alphabet and ends in zero, one, or two
=characters. - Decode — a Base64 string goes in, the original text comes back, byte for byte. A valid string's length is always a multiple of four.
- UTF-8 in, UTF-8 out — text is first turned into its UTF-8 bytes, then encoded, so accents, emoji, and non-Latin scripts round-trip correctly.
A worked Base64 example: encoding “Man”
"Man" is the classic Base64 example because it is exactly three bytes, so it encodes with no padding at all. We will turn Man into TWFu by hand, then confirm it against the tool.
Step 1 — Take the three bytes
In ASCII, M = 77, a = 97, n = 110. As 8-bit binary that is 01001101 01100001 01101110 — 24 bits in total.
Step 2 — Re-slice into four 6-bit groups
Regroup the same 24 bits as 010011 010110 000101 101110. Those four groups are the numbers 19, 22, 5, 46.
Step 3 — Look each number up in the alphabet
From the alphabet table: 19 → T, 22 → W, 5 → F, 46 → u. Joined together that is TWFu — the value the tool shows for "Man".
Shorten the input and padding appears. "Hi" is two bytes, so it encodes to SGk= — three real characters and one =. A single byte "M" encodes to TQ== — two characters and two =. Try each in the tool to watch the padding change with the input length.
Real-world uses for Base64
Base64 shows up anywhere binary data has to ride inside a text format. These are the cases you will meet most often as a developer.
| Use case | What gets encoded | Why Base64 |
|---|---|---|
| Data URIs | An image, font, or file inlined into HTML/CSS | Embeds the asset directly in the markup as data:image/png;base64,… with no extra request |
| Email attachments (MIME) | Any attached file | MIME uses Base64 to push binary through mail systems built for 7-bit text |
| HTTP Basic auth | The "user:password" string in the Authorization header | Encodes the credentials into header-safe characters (not encryption — see below) |
| JSON / API payloads | Binary blobs, certificates, small files | JSON is text-only, so raw bytes must be Base64 to fit in a string field |
| JWTs and tokens | The token's header and payload | Uses URL-safe Base64 so the token can sit in a URL or header |
Base64 is a transport encoding: in every case it makes binary safe to carry inside a text channel, then it is decoded back to the original bytes on arrival.
Base64 gotchas and common mistakes
Base64 is simple, but a few misunderstandings cause most of the bugs and security mistakes people make with it.
- It is not encryption. Base64 has no key and is trivially reversible. An HTTP Basic auth header is Base64, which is exactly why Basic auth must only ever run over HTTPS — the credentials are plainly readable, not protected.
- It grows the data ~33%. Four characters per three bytes means the encoded form is about a third larger. Inlining a big image as a data URI can bloat your HTML or CSS noticeably.
- URL-safe ≠ standard. The URL-safe variant swaps + for - and / for _ (and often drops the "=" padding) so the string is safe in a URL. Feed a URL-safe string to a standard decoder and it breaks. Match the decoder to the variant.
- UTF-8 first for non-ASCII text. Base64 encodes bytes, not characters. Text must be turned into UTF-8 bytes before encoding, or accents and emoji come back mangled. Browsers' raw btoa() famously fails on non-Latin-1 text for this reason.
- Whitespace can be valid or fatal. Some contexts (MIME) insert line breaks into long Base64; some decoders reject any character outside the alphabet. Strip stray spaces and newlines before decoding if a decode fails.
Is this Base64 tool safe to use?
Yes. The encode and decode both run entirely in your browser with plain JavaScript. Whatever you paste is never stored, logged, or sent to any server — there is no network request, so the tool works the same offline. That makes it safe to convert values you would not want to upload anywhere.
Remember the trade-off, though: because Base64 is encoding and not encryption, the output is not protected. If you need to actually conceal data, encrypt it (over TLS or with a real cipher) rather than relying on Base64. For changing how text is escaped for a URL instead of a transport channel, use our URL encoder / decoder; to produce a one-way fingerprint of data that cannot be reversed, see the hash generator.
Base64 definitions
How accurate is this Base64 encoder?
The conversion is exact. Base64 is a lossless, deterministic mapping defined bit for bit in RFC 4648, so encoding then decoding returns the original bytes unchanged every time — there is no rounding, estimate, or data loss. The tool uses the standard alphabet (A–Z, a–z, 0–9, +, /) with "=" padding.
If a result looks wrong, the cause is almost always a variant or input mismatch rather than the math: a URL-safe string ("-" and "_") fed to a standard decoder, stray whitespace from a copy-paste, or non-UTF-8 input. Match the alphabet and clean the input and the round-trip is perfect. For related transport and integrity tools, see the URL encoder and the hash generator.
Frequently asked questions about the free Base64 encoder / decoder
About this Base64 encoder / decoder
This Base64 encoder and decoder runs entirely in your browser. Whatever you paste is never stored, logged, or sent to any server — the conversion is plain JavaScript computed locally, so it works the same offline. It uses the standard RFC 4648 alphabet (A–Z, a–z, 0–9, +, /) with "=" padding, and encodes text as UTF-8 so accents and emoji round-trip correctly.
It is one of our free developer tools. Browse the full set on the all calculators page.