Base64 Encode/Decode
Encode or decode Base64 for text and files, Unicode-safe.
Related Tools
Percent-encode text for safe use in URLs.
Decode JWT header, payload, and signature with expiry and algorithm warnings.
Beautify and pretty-print JSON with configurable indentation.
Decode percent-encoded URL text back to plain text.
Escape HTML entities to safely display raw markup as text.
Unescape HTML entities back to raw characters.
Documentation
What is Base64?
Base64 turns arbitrary binary bytes into a string built only from letters, digits, +, /, and a trailing = padding — safe to embed in JSON, XML, email bodies, or data URIs that can't carry raw bytes. This tool converts text or files to and from that representation entirely in your browser.
How it works
Encoding first runs your text through TextEncoder to get UTF-8 bytes, then groups them into chunks and calls the browser's native btoa() — chunked so large inputs don't blow the call stack. Decoding reverses this with atob() and TextDecoder('utf-8'). Going through TextEncoder first is what makes this Unicode-safe — calling btoa() directly on a string throws on any character outside Latin1, so emoji or accented text would break it. The URL-safe toggle swaps +// for -/_ and strips the = padding on encode, then restores both before decoding.
Features
- Encode and decode text, Unicode-safe via TextEncoder/TextDecoder
- URL-safe variant (- and _ instead of + and /, no padding)
- Load any file and encode its raw bytes
- Download decoded output as a binary file
- Clear invalid-input error instead of silent garbage
Example
Input: DevFormats: JSON & Tools ✓
Output (standard Base64):
RGV2Rm9ybWF0czogSlNPTiAmIFRvb2xzIOKckw==
Output (URL-safe, no padding):
RGV2Rm9ybWF0czogSlNPTiAmIFRvb2xzIOKckw
Edge cases
Base64 length must be a multiple of 4 once padding is included — pasting a truncated string (missing its trailing = characters) makes atob() throw, which this tool surfaces as "Invalid Base64 input" rather than returning corrupted text. Standard Base64 containing + or / will also fail to decode if you leave URL-safe mode on, since those characters aren't in the URL-safe alphabet — match the mode to how the string was produced. Encoding already-encoded output ("double encoding") is a common mistake that inflates size and produces a string that needs decoding twice to recover the original.
Best practices
Use the URL-safe variant for anything going into a URL path, query string, or filename; use standard Base64 for JSON payloads, email (MIME), and data URIs where padding and +// are harmless. Base64 is an encoding, not encryption — never rely on it to protect sensitive data, since decoding requires no key at all.
Spec
RFC 4648 — The Base16, Base32, and Base64 Data Encodings
Frequently Asked Questions
Why not just use btoa/atob directly?▾
Native btoa() throws on any character outside Latin1, so it breaks on emoji or non-Latin text. This tool encodes via TextEncoder first, making it Unicode-safe.
What is the URL-safe variant?▾
Standard Base64 uses + and / characters, which have special meaning in URLs. The URL-safe variant replaces them with - and _ and drops padding, so the result can be used directly in a URL path or query string.
Can I encode a file, not just text?▾
Yes — click Load File to read any file as bytes and encode it, useful for embedding small images as data URIs.
What happens if I paste invalid Base64 to decode?▾
The tool reports "Invalid Base64 input" rather than silently producing garbage.
Is my data uploaded anywhere?▾
No — encoding and decoding both happen entirely in your browser.