Why does my decoded text look like random symbols?

The Base64 string probably represents binary data, such as an image, a compressed file or encrypted content, rather than text. Decoding it produces valid bytes, but they are not meaningful UTF 8 text. It can also happen if the original text was encoded with a different character set than UTF 8.

Why does the tool say my Base64 is invalid?

Valid Base64 contains only the 64 allowed characters plus optional = padding, and its length must fit the 4‑character grouping. Common causes are stray characters copied by accident, a truncated string, or a base64url string with and decoded without the URL safe option enabled.

Can I encode images or other files?

No. This tool is designed for text only. To embed an image in HTML or CSS you would need a tool that reads the file's raw bytes and produces a data URL.

Is Base64 safe for storing passwords?

No. Base64 can be decoded by anyone in a fraction of a second. Passwords should be stored with a dedicated slow hashing algorithm such as Argon2, scrypt or bcrypt.

What is the difference between padded and unpadded Base64?

Padding with = only makes the output length a multiple of four; it carries no information. Most decoders can reconstruct the data without it. base64url commonly omits padding because = is itself a reserved character in URLs.

Base64 Encoder and Decoder – Encode and Decode Text Online

Free Base64 encoder and decoder with full UTF-8 support and a URL-safe base64url option. Runs entirely in your browser, nothing is uploaded.

How to use the Base64 encoder and decoder

Choose whether you want to encode text to Base64 or decode Base64 back to text.
Type or paste your input into the text box. Accented letters, non-Latin scripts and emoji are all supported.
If the result will be used in a URL, a file name or a JSON Web Token, turn on the URL-safe option to get the base64url variant.
Read the result and copy it. If you are decoding and the input is not valid Base64, an error message tells you so instead of producing garbage.

What is Base64?

Base64 is a way of representing arbitrary bytes using only 64 printable ASCII characters: the uppercase letters A–Z, the lowercase letters a–z, the digits 0–9, and the two symbols + and /. The = character is used as padding at the end. It exists because many systems were designed to carry text, not raw binary data. Email bodies, HTTP headers, XML and JSON documents, and data URLs all expect characters that will survive being copied, logged and transmitted without being altered.

The algorithm works on groups of three bytes (24 bits) and splits them into four 6‑bit values, each of which maps to one of the 64 characters. That is why Base64 output is always about 33% larger than the input: every 3 bytes become 4 characters. When the input length is not a multiple of three, one or two = signs are appended so that the output length is a multiple of four. For example, the word Hi encodes to SGk= and Hello encodes to SGVsbG8=.

Text, bytes and UTF-8

Base64 encodes bytes, not characters, so text must first be turned into bytes. This tool uses UTF-8, the encoding used by almost every modern web page and API. That means café becomes Y2Fmw6k= and an emoji such as 👍 (four bytes in UTF-8) is encoded correctly and decodes back to the same emoji. Many quick scripts that rely on the browser’s older btoa() function fail on anything outside Latin-1; this tool does not have that limitation.

Standard Base64 vs. base64url

Standard Base64 uses + and /, which have special meanings in URLs and file paths. The URL-safe variant, called base64url, replaces + with - and / with _, and usually drops the = padding. It is the format used in JSON Web Tokens (JWT), in many OAuth parameters and in URL shorteners. Enable the URL-safe option when you need that format, and leave it off for email attachments, data URLs or configuration files that expect standard Base64.

Base64 is not encryption

This is the single most common misunderstanding. Base64 is an encoding: it has no key and no secret, and anyone can reverse it instantly. Encoding a password, an API key or personal data in Base64 does not protect it in any way. HTTP Basic authentication, for instance, sends username:password in Base64, which is why it must only be used over HTTPS. If you need confidentiality, use real encryption (such as AES) or a password hash (such as Argon2 or bcrypt), not Base64.

Privacy

All encoding and decoding happens locally in your browser with JavaScript. The text you enter is never sent to a server, stored or logged, so you can safely inspect tokens or configuration values. This tool works on text only; it does not accept file uploads.

Base64 Encoder and Decoder