How to use this Base64 tool
The tool has two modes. Text converts between plain text and Base64 in either direction. File / image reads a file from your device and gives you its Base64 representation, optionally wrapped as a data URL you can paste straight into HTML or CSS.
What Base64 is, and what it is not
Base64 represents arbitrary binary data using 64 printable ASCII characters. It exists because many systems — email headers, URLs, JSON string fields, XML documents, HTTP headers — can only carry text safely, and binary bytes passing through them get mangled or rejected.
The cost is size: every three bytes of input become four characters of output, so Base64 data is 33% larger than the original, plus padding. That overhead is the price of transport safety.
The critical thing to understand is that Base64 is not encryption. It is an encoding with no key and no secret. Anyone can decode it instantly — this page does it in a millisecond. A password stored as Base64 is a password stored in plain text with an extra step. It is worth stating because Base64-as-security is a genuinely common mistake in real systems.
Unicode is handled correctly here
A subtle bug affects many Base64 tools and a lot of hand-written JavaScript: the built-in
btoa() function only accepts characters in the 0–255 range. Feed it an emoji, a Chinese
character, or an accented letter above that range and it throws an error — or worse, silently
produces corrupt output.
This tool encodes text to UTF-8 bytes first, then Base64-encodes those bytes. Decoding reverses the process. That means "café", "日本語" and "🎉" all round-trip perfectly, which is what you need when the data is a name, an address or anything written by a human in a language other than English.
URL-safe Base64
Standard Base64 uses + and /, both of which have special meanings inside a
URL, and = for padding, which also causes trouble in query strings. URL-safe Base64 —
defined in RFC 4648 — substitutes - for + and _ for
/, and drops the padding.
Tick the URL-safe box when the output is going into a query parameter, a URL path segment, a cookie value, or a JWT. JSON Web Tokens use URL-safe Base64 for all three of their parts, which is why a JWT never contains a plus sign. Decoding accepts both variants automatically and restores missing padding, so you never have to think about which you have been given.
Files and data URLs
Switch to the file tab and drop in any file. You get its Base64 form, and for images you also get a preview so you can confirm you have the right file.
A data URL is the Base64 with a prefix — data:image/png;base64, — that tells the
browser what it is looking at. Paste one into an <img src> attribute or a CSS
background-image and the image renders with no separate network request. That is
genuinely useful for tiny assets: icons, a 1 KB logo in an HTML email, an SVG in a single-file
document, or a placeholder that must appear before anything else loads.
Use it sparingly. Embedded images cannot be cached separately from the document, they inflate your HTML or CSS by a third of the image's size, and they block rendering while the containing file parses. The rough rule: inline anything under about 2 KB, link to anything larger. The tool refuses files above 8 MB, because the resulting string is large enough to make the browser's text rendering crawl.
Where you will actually meet Base64
- JWT tokens. Three URL-safe Base64 segments separated by dots. Paste the middle one here to read the claims — and note that being able to read them proves the payload is not secret.
- HTTP Basic authentication. The header is literally
Basic base64(username:password), which is exactly why Basic auth over plain HTTP is unacceptable. - Email attachments. MIME encodes every binary attachment as Base64, which is why an emailed file arrives roughly a third larger than it left.
- API keys and certificates. PEM files are Base64-wrapped DER between
-----BEGIN-----markers. - Images in JSON. APIs that must carry binary through a text-only field Base64 it, though a separate upload endpoint is nearly always the better design.
Privacy
Everything is computed by browser built-ins inside this page. Nothing is uploaded. That is not a minor detail for this particular tool: the strings people decode most often are session tokens, API keys and auth headers, and pasting those into a website that transmits them would be handing over live credentials.