Encode and decode Base64 strings, files, and images. Perfect for developers, API testing, and data URIs.
Encode credentials for Basic Authentication headers. Convert username:password to Base64 for API requests, REST endpoints, and HTTP authentication. Essential for developers testing APIs and webhooks.
Embed images directly in HTML, CSS, or JSON. Convert images to Base64 strings for email templates, CSS backgrounds, or inline SVG. Eliminates external image requests and improves page load speed.
MIME email attachments use Base64 encoding. Convert files to Base64 for programmatic email sending, API file uploads, or data transmission. Works with PDFs, images, and documents.
Encode data for URLs and query parameters. Base64 makes binary data URL-safe by replacing special characters. Perfect for passing encrypted tokens, session data, or binary content in URLs.
Base64 is a binary-to-text encoding scheme that converts binary data into ASCII characters. It uses 64 characters (A-Z, a-z, 0-9, +, /) to represent data, making it safe for transmission in text-based systems like email, JSON, and URLs.
Base64 is a way to represent any binary data using only 64 safe, printable characters: A–Z, a–z, 0–9, + and / (with = for padding). It exists because many systems — email, JSON, XML, URLs, HTTP headers — were designed to carry text, and raw binary bytes passing through them get corrupted or rejected. Base64 takes every 3 bytes of input and spreads them across 4 text characters, which is why encoded output is always about 33% larger than the original.
The crucial thing Base64 is not: encryption. It provides zero secrecy — anyone can decode it instantly, as this page demonstrates. If you see Base64 used to "hide" passwords or API keys, that's a security bug, not a security measure. Encoding is about transport safety, never about confidentiality.
Data URIs. Small images embedded directly in HTML or CSS as data:image/png;base64,iVBORw0... save an HTTP request. Great for icons under a few KB; counterproductive for large images because of the 33% size penalty.
HTTP Basic Auth. The Authorization: Basic header is just username:password Base64-encoded — readable by anyone who sees the header, which is why Basic Auth is only acceptable over HTTPS.
JWTs and API payloads. JSON Web Tokens are three base64url-encoded segments; decoding them is how you debug auth issues (our JWT Decoder automates it). APIs also wrap binary attachments — PDFs, images, certificates — in Base64 to fit them inside JSON.
Email attachments. Every attachment you've ever sent traveled as Base64 inside the MIME message — it's the reason a 10 MB attachment counts as ~13 MB against a mailbox limit.
Base64 operates on bytes, but text has to become bytes first — and the encoding used matters. "café" in UTF-8 is five bytes; in Latin-1 it's four; the Base64 differs accordingly. JavaScript's legacy btoa() throws on any character outside Latin-1 (the infamous "InvalidCharacterError" with emoji), which is why proper tools — including this one — encode the text as UTF-8 bytes before applying Base64. If a decoded string comes out as mojibake like café, the encoder and decoder disagreed about the character encoding, not about the Base64.
No — it's reversible by anyone in milliseconds. Use real encryption for secrecy and hashing (see our Hash Generator) for integrity. Base64 only makes data transport-safe.
Either the input wasn't valid Base64 (check for truncation or missing padding), or the decoded bytes aren't text at all — decoding a Base64-encoded image produces binary data, which renders as gibberish when displayed as text.
Padding. Base64 works in blocks of 3 input bytes; when the input length isn't a multiple of 3, one or two = characters pad the final block. Some variants (like the base64url used in JWTs) omit padding entirely.
Standard Base64 uses + and /, which break inside URLs. Base64url swaps them for - and _ so tokens and parameters survive URLs unchanged. If a JWT segment fails to decode, this is usually why. For URL parameter encoding itself, use the URL Encoder.
No — encoding and decoding run entirely in your browser, so tokens, credentials, and payloads you paste here stay on your machine.