Base64 Encoder & Decoder
A Base64 encoder decoder for text, covering the URL-safe alphabet, padding and the 33% size overhead, and why Base64 is not encryption.
What Base64 Encoder & Decoder Does
Base64 encodes arbitrary binary data using only 64 printable ASCII characters, so it can pass through channels that were designed for text and would otherwise corrupt raw bytes. It exists because email, URLs, JSON and XML all predate or exclude 8-bit-clean binary transport.
The scheme is defined in RFC 4648. It takes three input bytes (24 bits) and re-splits them into four 6-bit groups, each mapped to one character of the alphabet A–Z, a–z, 0–9, plus "+" and "/". When the input length is not a multiple of three, the final group is padded with "=" characters.
The most common misunderstanding is worth stating plainly: Base64 is an encoding, not encryption. It provides no confidentiality whatsoever; anyone can decode it, this tool included. Credentials in a Base64 string are credentials in plain sight.
How to Use Base64 Encoder & Decoder
- Choose "Encode" or "Decode" mode
- Paste your text or Base64 string
- Click the action button
- Copy the result
Formula Used by Base64 Encoder & Decoder
Encoded size
encoded_length = 4 × ⌈n / 3⌉
- n
- Length of the input in bytes
- ⌈ ⌉
- Ceiling: round up to the next whole number
Worked example
A 100 KB image (102,400 bytes) embedded as a data URI.
- ⌈102400 / 3⌉ = 34,134
- 4 × 34,134 = 136,536 bytes
Result: 136,536 bytes, roughly a 33% size increase, which is why inlining large images as Base64 hurts page weight.
Base64 Alphabet Variants (RFC 4648)
Three encodings share the same algorithm but differ in the last two characters. Using the wrong variant is the usual cause of "invalid character" decode failures.
| Variant | Index 62 | Index 63 | Padding | Typical use |
|---|---|---|---|---|
| Standard (§4) | + | / | = required | MIME, email, data URIs |
| URL and filename safe (§5) | - | _ | often omitted | JWTs, URL parameters, filenames |
| Base32 (§6) | n/a | n/a | = required | Case-insensitive contexts, TOTP secrets |
Source: RFC 4648 — The Base16, Base32, and Base64 Data Encodings
Worked Encoding: "Man" → "TWFu"
The canonical three-byte example, showing the 24-bit regrouping.
| Stage | M | a | n |
|---|---|---|---|
| ASCII decimal | 77 | 97 | 110 |
| 8-bit binary | 01001101 | 01100001 | 01101110 |
| 24-bit stream | 010011 010110 | 000101 101110 | (regrouped into 4 × 6 bits) |
| 6-bit values | 19, 22 | 5, 46 | — |
| Base64 output | T, W | F, u | → "TWFu" |
Padding Behavior
How many "=" characters appear depends on the input length modulo 3.
| Input bytes mod 3 | Padding | Example input | Example output |
|---|---|---|---|
| 0 | none | Man | TWFu |
| 1 | == | M | TQ== |
| 2 | = | Ma | TWE= |
How to Read Your Result
Base64 is not security
Encoding is reversible by design and requires no key. HTTP Basic authentication transmits "username:password" as Base64, which is why it is only acceptable over TLS: the encoding contributes nothing to protecting the credential. Treat any Base64 blob as though its contents were printed in the clear.
Why decoding fails
The usual causes are a URL-safe string being decoded with the standard alphabet (the "-" and "_" characters are rejected), missing padding where the decoder requires it, or whitespace and line breaks introduced by copy-paste from an email header. MIME permits line breaks every 76 characters; strict decoders do not.
The 33% overhead
Four output characters per three input bytes is a fixed 4:3 expansion, before padding. For data URIs this is a real cost: inlining a 50 KB icon adds about 67 KB to the HTML, which is not compressed away as effectively as the original binary would have been.
Limitations & Accuracy Notes
- This tool processes text in your browser and treats input as UTF-8. Encoding a string containing characters outside the Basic Multilingual Plane relies on correct UTF-8 handling before the Base64 step, so decode results are only meaningful if the original encoder also used UTF-8.
- Base64 provides no integrity checking. A single altered character produces different bytes with no error, unless it happens to break the padding.
- Do not use this tool for secrets you would not paste into a text box. Although processing happens locally in your browser, treat any credential handling as a habit worth avoiding.
Frequently Asked Questions
What is Base64 encoding?
Base64 is a binary-to-text encoding scheme that converts binary data into a set of 64 printable ASCII characters. It is commonly used in email, URLs, and data transfer.
Is Base64 encoding the same as encryption?
No. Base64 is an encoding scheme rather than encryption. It does not provide any security, since anyone can decode Base64 data. It is used for data transport, not for keeping secrets.
Why does Base64 output sometimes end with = signs?
The = characters are padding, added when the input length is not evenly divisible by 3 bytes, since Base64 encodes data in 3-byte (4-character) blocks.
Does Base64 increase file size?
Yes. Base64 expands data by roughly 33%, since every 3 bytes of binary input become 4 ASCII characters of output, which is the tradeoff for making binary data safely transportable as text.
Is Base64 encryption?
No, and this is the most important thing to know about it. Base64 is a reversible encoding with no key, designed to carry binary data through systems that only handle text. Anyone can decode it. A secret stored Base64-encoded is stored in plain text with an extra step.
Why does encoded output end in one or two equals signs?
That is padding. Base64 works on three-byte groups, and when the input length is not a multiple of three the final group is padded to keep the output a multiple of four characters. One equals sign means the input had two bytes left over, two means one byte.
What is the difference between Base64 and Base64url?
Base64url replaces the two characters that cause trouble in URLs and filenames (plus and slash) with hyphen and underscore, and usually drops the padding. It is what JWTs use. Decoding one with a strict standard Base64 decoder will fail.
Why did my text come back garbled after decoding?
Almost always a character encoding mismatch. Base64 encodes bytes, not characters, so text has to be converted to bytes first, and if it was encoded as UTF-8 and decoded as something else, accented and non-Latin characters break. This tool uses UTF-8 throughout.
How much larger does Base64 make data?
About 33% larger, because every three bytes become four characters. That is the cost of the format and it is why embedding large images as Base64 data URIs in HTML or CSS increases page weight noticeably.
Is my data sent to a server?
No. Encoding and decoding both run in your browser.
References & Further Reading
- RFC 4648 — The Base16, Base32, and Base64 Data Encodings — The normative specification, including both alphabets
- RFC 3986 — URI Generic Syntax — Why URL-safe Base64 exists: "+" and "/" are reserved in URIs