🔐 Base64 Encoder & Decoder

A Base64 encoder decoder for text, covering the URL-safe alphabet, padding and the 33% size overhead — and why Base64 is not encryption.

✓ Free✓ No Signup Required✓ Browser-Based

Text to Encode

What Base64 Encoder & Decoder Does

Base64 encodes arbitrary binary data using only 64 printable ASCII characters, so it can pass through channels that were designed for text and would otherwise corrupt raw bytes. It exists because email, URLs, JSON and XML all predate or exclude 8-bit-clean binary transport.

The scheme is defined in RFC 4648. It takes three input bytes (24 bits) and re-splits them into four 6-bit groups, each mapped to one character of the alphabet A–Z, a–z, 0–9, plus "+" and "/". When the input length is not a multiple of three, the final group is padded with "=" characters.

The most common misunderstanding is worth stating plainly: Base64 is an encoding, not encryption. It provides no confidentiality whatsoever — anyone can decode it instantly, including this tool. Credentials in a Base64 string are credentials in plain sight.

How to Use Base64 Encoder & Decoder

Choose "Encode" or "Decode" mode
Paste your text or Base64 string
Click the action button
Copy the result

Formula Used by Base64 Encoder & Decoder

Encoded size

encoded_length = 4 × ⌈n / 3⌉

n: Length of the input in bytes
⌈ ⌉: Ceiling — round up to the next whole number

Worked example

A 100 KB image (102,400 bytes) embedded as a data URI.

⌈102400 / 3⌉ = 34,134
4 × 34,134 = 136,536 bytes

Result: 136,536 bytes — roughly a 33% size increase, which is why inlining large images as Base64 hurts page weight.

Base64 Alphabet Variants (RFC 4648)

Three encodings share the same algorithm but differ in the last two characters. Using the wrong variant is the usual cause of "invalid character" decode failures.

Variant	Index 62	Index 63	Padding	Typical use
Standard (§4)	+	/	= required	MIME, email, data URIs
URL and filename safe (§5)	-	_	often omitted	JWTs, URL parameters, filenames
Base32 (§6)	n/a	n/a	= required	Case-insensitive contexts, TOTP secrets

Source: RFC 4648 — The Base16, Base32, and Base64 Data Encodings

Worked Encoding: "Man" → "TWFu"

The canonical three-byte example, showing the 24-bit regrouping.

Stage	M	a	n
ASCII decimal	77	97	110
8-bit binary	01001101	01100001	01101110
24-bit stream	010011 010110	000101 101110	(regrouped into 4 × 6 bits)
6-bit values	19, 22	5, 46	—
Base64 output	T, W	F, u	→ "TWFu"

Padding Behavior

How many "=" characters appear depends on the input length modulo 3.

Input bytes mod 3	Padding	Example input	Example output
0	none	Man	TWFu
1	==	M	TQ==
2	=	Ma	TWE=

How to Read Your Result

Base64 is not security

Encoding is reversible by design and requires no key. HTTP Basic authentication transmits "username:password" as Base64, which is why it is only acceptable over TLS — the encoding contributes nothing to protecting the credential. Treat any Base64 blob as though its contents were printed in the clear.

Why decoding fails

The usual causes are a URL-safe string being decoded with the standard alphabet (the "-" and "_" characters are rejected), missing padding where the decoder requires it, or whitespace and line breaks introduced by copy-paste from an email header. MIME permits line breaks every 76 characters; strict decoders do not.

The 33% overhead

Four output characters per three input bytes is a fixed 4:3 expansion, before padding. For data URIs this is a real cost: inlining a 50 KB icon adds about 67 KB to the HTML, which is not compressed away as effectively as the original binary would have been.

Limitations & Accuracy Notes

This tool processes text in your browser and treats input as UTF-8. Encoding a string containing characters outside the Basic Multilingual Plane relies on correct UTF-8 handling before the Base64 step — decode results are only meaningful if the original encoder also used UTF-8.
Base64 provides no integrity checking. A single altered character produces different bytes with no error, unless it happens to break the padding.
Do not use this tool for secrets you would not paste into a text box. Although processing happens locally in your browser, treat any credential handling as a habit worth avoiding.

Frequently Asked Questions

What is Base64 encoding?

Base64 is a binary-to-text encoding scheme that converts binary data into a set of 64 printable ASCII characters. It is commonly used in email, URLs, and data transfer.

Is Base64 encoding the same as encryption?

No, Base64 is an encoding scheme, not encryption. It does not provide any security — anyone can decode Base64 data. It is used for data transport, not secrecy.

Is Base64 encryption?

No, and this is the most important thing to know about it. Base64 is a reversible encoding with no key, designed to carry binary data through systems that only handle text. Anyone can decode it instantly. A secret stored Base64-encoded is stored in plain text with an extra step.

Why does encoded output end in one or two equals signs?

That is padding. Base64 works on three-byte groups, and when the input length is not a multiple of three the final group is padded to keep the output a multiple of four characters. One equals sign means the input had two bytes left over, two means one byte.

What is the difference between Base64 and Base64url?

Base64url replaces the two characters that cause trouble in URLs and filenames — plus and slash — with hyphen and underscore, and usually drops the padding. It is what JWTs use. Decoding one with a strict standard Base64 decoder will fail.

Why did my text come back garbled after decoding?

Almost always a character encoding mismatch. Base64 encodes bytes, not characters, so text has to be converted to bytes first — and if it was encoded as UTF-8 and decoded as something else, accented and non-Latin characters break. This tool uses UTF-8 throughout.

How much larger does Base64 make data?

About 33% larger, because every three bytes become four characters. That is the cost of the format and it is why embedding large images as Base64 data URIs in HTML or CSS increases page weight noticeably.

Is my data sent to a server?

No. Encoding and decoding both run in your browser.

References & Further Reading

RFC 4648 — The Base16, Base32, and Base64 Data Encodings — The normative specification, including both alphabets
RFC 3986 — URI Generic Syntax — Why URL-safe Base64 exists: "+" and "/" are reserved in URIs

By OnlineToolHubs Team • September 2026