LOCAL STRING CONVERTER

Base64 Encoder / Decoder

Convert strings to and from Base64 formatting instantly. Processed locally in your browser to secure raw payload data.

Input String

Base64 Encoded Output

Encoding Standard

UTF-8 Safe Encoding

Base64 is a binary-to-text encoding scheme that translates binary data into a set of 64 printable characters. It is commonly used when raw byte sequences need to be transferred over mediums that only support standard text.

GeneratePass uses TextEncoder and TextDecoder buffers to convert Unicode strings safely without character corruption.

Introduction

Binary data can't travel safely through text-only channels — email, URLs, JSON, and XML all expect ASCII. Base64 encoding solves this by translating every 3 bytes of binary data into 4 printable ASCII characters, ensuring data survives any text-based transport layer. The Base64 Converter handles all three major variants: standard Base64 (A-Z, a-z, 0-9, + /), URL-safe Base64 (A-Z, a-z, 0-9, - _), and Base32 (A-Z, 2-7). Whether you're encoding JWT tokens, embedding images in HTML, or serializing binary data for JSON APIs, this tool converts between formats with accurate, standards-compliant output.

What This Tool Does

Why It Matters

Base64 is everywhere in modern software. JWT tokens are Base64URL-encoded payloads. Email attachments use MIME Base64 encoding. Data URIs embed images as Base64 strings. API responses serialize binary fields as Base64. But using the wrong variant breaks things: standard Base64's + and / characters are not URL-safe, causing encoding errors in query parameters. Base64URL's - and _ characters break email parsers. Understanding the three variants and when to use each prevents the kind of silent data corruption that surfaces as mysterious 'invalid character' errors in production systems.

How It Works

Step-by-Step Examples

Example 1: Encode a string to Base64 for email transmission

Enter the text: Hello, World! — this is 13 ASCII characters (13 bytes)

Select Base64 (standard) encoding

Click Encode to produce the Base64 representation

Observe the output is 20 characters — each 3 input bytes produce 4 output characters, plus padding

ResultSGVsbG8sIFdvcmxkIQ== — 20 characters, MIME-compatible, safe for email headers

Example 2: Decode a Base64URL token from a JWT header

Paste the Base64URL-encoded string: eyJhbGciOiJIUzI1NiJ9

Select Base64URL encoding variant

Click Decode to reverse the encoding

Observe the decoded JSON: {"alg":"HS256"} — the JWT algorithm header

Result{"alg":"HS256"} — the decoded JWT header revealing the signing algorithm

Code Examples

javascriptEncode and decode Base64, Base64URL, and Base32

// Standard Base64
function base64Encode(text) {
  return btoa(unescape(encodeURIComponent(text)));
}

function base64Decode(encoded) {
  return decodeURIComponent(escape(atob(encoded)));
}

// Base64URL (no +/ padding)
function base64URLEncode(text) {
  return btoa(unescape(encodeURIComponent(text)))
    .replace(/\+/g, '-')
    .replace(/\//g, '_')
    .replace(/=+$/, '');
}

function base64URLDecode(encoded) {
  let base64 = encoded.replace(/-/g, '+').replace(/_/g, '/');
  while (base64.length % 4) base64 += '=';
  return decodeURIComponent(escape(atob(base64)));
}

// Base32
function base32Encode(text) {
  const bytes = new TextEncoder().encode(text);
  let bits = '';
  bytes.forEach(b => bits += b.toString(2).padStart(8, '0'));
  while (bits.length % 5) bits += '0';
  const chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567';
  let result = '';
  for (let i = 0; i < bits.length; i += 5) {
    result += chars[parseInt(bits.slice(i, i + 5), 2)];
  }
  return result;
}

// Usage
const text = 'Hello, World!';
console.log(base64Encode(text));        // SGVsbG8sIFdvcmxkIQ==
console.log(base64URLEncode(text));    // SGVsbG8sIFdvcmxkIQ
console.log(base32Encode(text));       // JBSWY3DPF3T64ZL3

javascriptDecode a JWT payload from Base64URL

function decodeJWTPayload(token) {
  const parts = token.split('.');
  if (parts.length < 2) throw new Error('Invalid JWT format');

  const header = JSON.parse(base64URLDecode(parts[0]));
  const payload = JSON.parse(base64URLDecode(parts[1]));
  const signature = parts[2] || null;

  return { header, payload, signature };
}

// Usage with a real JWT
const token = 'eyJhbGciOiJIUzI1NiJ9.eyJ1c2VySWQiOiIxMjM0NTY3ODkwIn0.signature_here';
const decoded = decodeJWTPayload(token);
console.log(decoded.header);  // { alg: 'HS256' }
console.log(decoded.payload); // { userId: '1234567890' }

Base64 Variant Comparison

Variant	Characters	Padding	URL-Safe	Email-Safe	Use Case
Standard Base64	A-Z a-z 0-9 + /	Yes (=)	No (+/ need encoding)	Yes	MIME email, data URIs
Base64URL	A-Z a-z 0-9 - _	Optional	Yes	No (-_ not MIME standard)	URLs, JWT tokens, query params
Base32	A-Z 2-7	Yes (=)	Yes	Yes	TOTP secrets, case-insensitive systems

Base64 Encoding Overhead

Input Size	Base64 Output	Base64URL Output	Base32 Output	Overhead
1 byte	4 chars (+ pad)	4 chars	8 chars (+ pad)	200-700%
3 bytes	4 chars	4 chars	8 chars	33-167%
16 bytes	24 chars	24 chars	32 chars	50-100%
32 bytes	44 chars	44 chars	52 chars	38-63%
64 bytes	88 chars	88 chars	104 chars	38-63%

Benefits

Supports all three major encoding variants: standard Base64, Base64URL, and Base32 with correct character sets.
Bidirectional encoding/decoding with accurate handling of padding characters across all formats.
UTF-8 safe — correctly handles multi-byte characters (emoji, CJK, accented letters) without mojibake.
Instant, client-side conversion with zero network requests — your data never leaves the browser.

Use Cases

Encoding JWT token headers and payloads for web authentication systems that use Base64URL format.

Embedding images and binary data as data URIs in HTML and CSS without external file references.

Transmitting binary data through text-only channels like email bodies, JSON APIs, and XML documents.

Decoding Base64-encoded configuration values, database fields, or API response parameters.

Common Mistakes to Avoid

✗

Using standard Base64 in URL query parameters — the + and / characters get misinterpreted as spaces and path separators.

✗

Forgetting that Base64URL padding is optional — some decoders fail if = is missing, while others accept it.

✗

Assuming Base64 is encryption — it is encoding, not encryption. Anyone can decode Base64 with no key.

✗

Applying Base64 to already-encoded data — double-encoding bloats output by 78% and produces garbage on decode.

Security Implications

Base64 is an encoding scheme, not encryption — it provides zero confidentiality. Anyone who intercepts Base64-encoded data can decode it instantly with no key. Never use Base64 to protect sensitive information like passwords, API keys, or personal data. Base64URL encoding in JWTs exposes the header and payload in plaintext; only the signature is verified, not encrypted. If you need to protect transmitted data, use TLS in addition to Base64 encoding.

Security Information

Frequently Asked Questions

What is the difference between Base64 and Base64URL?+

Why is Base64 not encryption?+

How do I handle padding in Base64URL?+

References & Further Reading

Fundamentals

What is Base64?

Base64 is a binary-to-text encoding standard defined in RFC 4648. It represents binary data using 64 printable ASCII characters, making it safe to transmit through systems designed for plain text. It is not an encryption method.

The Base64 character set consists of uppercase letters A-Z, lowercase letters a-z, digits 0-9, and two symbols: plus (+) and forward slash (/). These 64 characters encode any binary value using printable ASCII.

Step-by-Step

How Base64 Encoding Works

Base64 encoding converts 3 bytes (24 bits) into 4 characters (each representing 6 bits). Each 6-bit value maps to a character in the Base64 alphabet. When input length is not divisible by 3, padding characters (=) are added.

Padding with =

When input is not evenly divisible by 3 bytes, padding (=) is appended. One = indicates 1 extra byte; two == indicates 2 extra bytes. The padded output always has a length divisible by 4.

Critical Distinction

Base64 vs Encryption

Base64 is an encoding format, not encryption. It does not use a secret key and is completely reversible. Anyone with the Base64 string can decode it instantly. Never use Base64 to protect sensitive data.

If you need to secure data, use proper encryption algorithms like AES-256-GCM. For data integrity, use SHA-256 hashing. Base64 is purely for data format conversion.

Applications

Use Cases

Email Attachments (MIME)

Binary attachments are Base64-encoded to safely travel through text-only email protocols.

Data URIs

Embed images and fonts directly in HTML/CSS using Base64-encoded data URIs.

JWT Tokens

JSON Web Tokens use Base64URL encoding for header and payload segments.

API Data Transport

Embed binary payloads in JSON or XML when the transport cannot handle raw bytes.

Pitfalls

Common Mistakes

Treating Base64 as Encryption

Base64 provides zero confidentiality. Anyone can decode it. Always use proper encryption for sensitive data.

URL Encoding Confusion

Standard Base64 uses + and / which are special in URLs. Use URL-safe Base64 (- and _) for query parameters.

Not Handling Padding

Always verify Base64 padding. Missing or extra = characters cause decoding errors.

Related Tools

Related Resources

Encoding

Base64 Encoder / Decoder

UTF-8 Safe Encoding

Introduction

What This Tool Does

Why It Matters

How It Works

Step-by-Step Examples

Code Examples

Base64 Variant Comparison

Base64 Encoding Overhead

Benefits

Use Cases

Common Mistakes to Avoid

Security Implications

Security Information

Frequently Asked Questions

References & Further Reading

What is Base64?

How Base64 Encoding Works

Padding with =

Base64 vs Encryption

Use Cases

Email Attachments (MIME)

Data URIs

JWT Tokens

API Data Transport

Common Mistakes

Treating Base64 as Encryption

URL Encoding Confusion

Not Handling Padding

Related Resources

URL Encoder

SHA-256 Generator

Encoding Utilities

No matches found