Skip to content
TrueScalers

Base64 encoder and decoder

Base64 encodes binary data as 64 printable ASCII characters, representing every 3 bytes as 4 characters. Encoded output is therefore about 33% larger than the input. "Hello, World!" is 13 bytes and encodes to the 20-character string SGVsbG8sIFdvcmxkIQ==, where the trailing equals signs pad the final group.

Loading tool…

How to encode and decode Base64

  1. 01

    Choose a direction

    Select encoding text into Base64, or decoding Base64 back into text. The panes relabel to match.

  2. 02

    Paste your input

    Type or paste into the left pane. Conversion runs as you type, with no button to press and no upload.

  3. 03

    Pick the alphabet

    Switch on URL-safe output to use - and _ instead of + and / and drop the padding, for use in URLs and JWTs.

  4. 04

    Copy the result

    Copy the output, or press "Use output as input" to chain another conversion such as a double decode.

The formula

encoded length = 4 × ⌈n ÷ 3⌉,   overhead is 33.3%
n
The number of input bytes — not characters, since one UTF-8 character can be up to 4 bytes.
encoded length
The output length in characters, always a multiple of 4 when padded.
=
Padding appended so the output length is a multiple of 4. One byte remaining adds "==", two bytes adds "=".
alphabet
A–Z, a–z, 0–9 and + / in the standard variant; - and _ replace + and / in the URL-safe variant.

Base64 is an encoding, not encryption. It provides no confidentiality whatsoever — anyone can decode it instantly and without a key. Its purpose is to move binary data safely through channels that only handle text, such as email bodies, JSON strings, data URIs and HTTP headers.

Worked example

Input
Hello, World!
Direction
Encode text to Base64
URL-safe
off
Result
SGVsbG8sIFdvcmxkIQ==

The input is 13 bytes of ASCII. Base64 processes 3 bytes at a time, so 13 bytes form 4 complete groups of 3 with 1 byte left over: ⌈13 ÷ 3⌉ = 5 groups. Each group becomes 4 characters, giving 20 characters of output. The final group holds only 1 byte, so it produces 2 meaningful characters plus "==" of padding. Output is 20 characters against 13 input bytes, the expected 33% overhead.

Frequently asked questions

What is Base64 used for?

Base64 moves binary data through channels that only accept text. Common uses are embedding small images directly in CSS or HTML as data URIs, attaching files to email under MIME, carrying credentials in an HTTP Basic authorization header, and placing binary blobs inside JSON, which has no native binary type.

Is Base64 encryption?

No, and treating it as such is a genuine security mistake. Base64 is a reversible encoding with no key: anyone can decode it in one step. Credentials in an HTTP Basic header are Base64-encoded, not protected, which is exactly why Basic authentication is only safe over HTTPS where the transport provides the encryption.

Why does Base64 make data larger?

Base64 represents 3 bytes of input using 4 output characters, because each output character carries only 6 bits of information rather than 8. That is a fixed 33.3% expansion, plus up to 2 characters of padding. Embedding a 100 kB image as a data URI therefore costs about 133 kB in the document.

What is URL-safe Base64?

The standard alphabet includes + and /, which have reserved meanings in URLs, and = padding, which conflicts with query-string syntax. The URL-safe variant defined in RFC 4648 section 5 substitutes - for + and _ for / and omits the padding. JSON Web Tokens use this variant for every one of their three segments.

Why does encoding fail on emoji or accented characters?

The browser's built-in btoa function operates on Latin-1 and throws on any character above U+00FF, so "café" and every emoji fail outright. This tool encodes the text to UTF-8 bytes first and Base64-encodes those bytes, which handles the full Unicode range correctly and round-trips exactly.

How do you know if a string is valid Base64?

Valid Base64 contains only characters from its alphabet, and its length is a multiple of 4 once padding is included. This tool restores missing padding automatically, since URL-safe output legitimately omits it, and reports an error if any character falls outside the alphabet or the length cannot be reconciled.

Is pasted data sent anywhere?

No. Encoding and decoding happen entirely in this page using JavaScript running in your browser. Nothing is transmitted, logged or stored, and this site has no server-side code capable of receiving text. Decoding a JWT that contains customer data or an internal token is therefore safe here.

Sources

Last reviewed: · Formula and sources verified by Syed Aqeel Ahmad Gillani. See the methodology for how every calculation is derived.

Related tools