ENCODE AND DECODE BASE64

Base64 Encoder / Decoder

Convert strings to and from Base64 formatting instantly. Processed locally in your browser to secure raw payload data.

Input String

Base64 Encoded Output

Decision Guide

When Should I Use Base64?

Embedding images in HTML/CSS

Convert small images to Base64 data URIs to embed them directly in HTML or CSS, reducing HTTP requests.

Email attachments (MIME)

Email protocols only support ASCII text. Base64 encodes binary attachments (images, PDFs) for safe email transport.

JWT token payloads

JSON Web Tokens use Base64URL encoding for the header and payload. Understand the encoding when debugging JWTs.

Transmitting binary data in JSON

JSON does not support binary data. Base64 encodes binary blobs as safe ASCII strings for API transport.

Critical Warning

Base64 Is NOT Encryption

Never use for passwords

Base64 is easily reversible. Anyone can decode it. Use the Password Generator for credentials.

Never use for encrypting sensitive data

Base64 provides zero security. It is an encoding, not encryption. Use AES or other encryption algorithms for sensitive data.

Never use for hashing

Base64 is reversible. Use SHA-256 for one-way hashing or HMAC for authenticated hashing.

Next Steps

What to Do After Encoding?

Copy the Base64 string — Use it in data URIs, email attachments, or API payloads.

Decode to verify — Switch to "Base64 to Text" mode to confirm the round-trip works correctly.

For security — If you need to encrypt data, use AES. If you need to hash, use SHA-256.

URL-safe encoding — For URLs, replace + with -, / with _, and remove trailing = padding.

Real-World Scenario

Embedding an image directly in CSS

1. Paste your image data or text into the input field above

2. Copy the Base64 string

3. Use it in CSS: background-image: url(data:image/png;base64,YOUR_STRING)

4. This eliminates an extra HTTP request for small images

5. Best for images under 10KB — larger images increase page size

Understanding the Output

What Base64 Encoding Does

Base64 converts binary or text data into a limited character set (A-Z, a-z, 0-9, +, /). The output is not encrypted — anyone can decode it. Here is what to look for:

The output is about 33% larger

Every 3 bytes of input become 4 Base64 characters. A 100-byte string becomes ~133 characters. This overhead is the cost of safe transport.

Padding characters (=) are normal

Base64 uses = at the end to fill incomplete blocks. "aGVsbG8=" decodes to "hello". The = signs are part of the format, not corruption.

Encoding ≠ Encryption

Base64 is encoding, not encryption. It provides zero security. Anyone can decode a Base64 string. Do not use it to protect passwords, secrets, or sensitive data.

Encoding Standard

UTF-8 Safe Encoding

Base64 is a binary-to-text encoding scheme that translates binary data into a set of 64 printable characters. It is commonly used when raw byte sequences need to be transferred over mediums that only support standard text.

GeneratePass uses TextEncoder and TextDecoder buffers to convert Unicode strings safely without character corruption.

Introduction

Binary data can't travel safely through text-only channels — email, URLs, JSON, and XML all expect ASCII. Base64 encoding solves this by translating every 3 bytes of binary data into 4 printable ASCII characters, ensuring data survives any text-based transport layer. The Base64 Converter handles all three major variants: standard Base64 (A-Z, a-z, 0-9, + /), URL-safe Base64 (A-Z, a-z, 0-9, - _), and Base32 (A-Z, 2-7). Whether you're encoding JWT tokens, embedding images in HTML, or serializing binary data for JSON APIs, this tool converts between formats with accurate, standards-compliant output.

What This Tool Does

Why It Matters

Base64 is everywhere in modern software. JWT tokens are Base64URL-encoded payloads. Email attachments use MIME Base64 encoding. Data URIs embed images as Base64 strings. API responses serialize binary fields as Base64. But using the wrong variant breaks things: standard Base64's + and / characters are not URL-safe, causing encoding errors in query parameters. Base64URL's - and _ characters break email parsers. Understanding the three variants and when to use each prevents the kind of silent data corruption that surfaces as mysterious 'invalid character' errors in production systems.

How It Works

Step-by-Step Examples

Example 1: Encode a string to Base64 for email transmission

Enter the text: Hello, World! — this is 13 ASCII characters (13 bytes)

Select Base64 (standard) encoding

Click Encode to produce the Base64 representation

Observe the output is 20 characters — each 3 input bytes produce 4 output characters, plus padding

ResultSGVsbG8sIFdvcmxkIQ== — 20 characters, MIME-compatible, safe for email headers

Example 2: Decode a Base64URL token from a JWT header

Paste the Base64URL-encoded string: eyJhbGciOiJIUzI1NiJ9

Select Base64URL encoding variant

Click Decode to reverse the encoding

Observe the decoded JSON: {"alg":"HS256"} — the JWT algorithm header

Result{"alg":"HS256"} — the decoded JWT header revealing the signing algorithm

Code Examples

javascriptEncode and decode Base64, Base64URL, and Base32

// Standard Base64
function base64Encode(text) {
  return btoa(unescape(encodeURIComponent(text)));
}

function base64Decode(encoded) {
  return decodeURIComponent(escape(atob(encoded)));
}

// Base64URL (no +/ padding)
function base64URLEncode(text) {
  return btoa(unescape(encodeURIComponent(text)))
    .replace(/\+/g, '-')
    .replace(/\//g, '_')
    .replace(/=+$/, '');
}

function base64URLDecode(encoded) {
  let base64 = encoded.replace(/-/g, '+').replace(/_/g, '/');
  while (base64.length % 4) base64 += '=';
  return decodeURIComponent(escape(atob(base64)));
}

// Base32
function base32Encode(text) {
  const bytes = new TextEncoder().encode(text);
  let bits = '';
  bytes.forEach(b => bits += b.toString(2).padStart(8, '0'));
  while (bits.length % 5) bits += '0';
  const chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567';
  let result = '';
  for (let i = 0; i < bits.length; i += 5) {
    result += chars[parseInt(bits.slice(i, i + 5), 2)];
  }
  return result;
}

// Usage
const text = 'Hello, World!';
console.log(base64Encode(text));        // SGVsbG8sIFdvcmxkIQ==
console.log(base64URLEncode(text));    // SGVsbG8sIFdvcmxkIQ
console.log(base32Encode(text));       // JBSWY3DPF3T64ZL3

javascriptDecode a JWT payload from Base64URL

function decodeJWTPayload(token) {
  const parts = token.split('.');
  if (parts.length < 2) throw new Error('Invalid JWT format');

  const header = JSON.parse(base64URLDecode(parts[0]));
  const payload = JSON.parse(base64URLDecode(parts[1]));
  const signature = parts[2] || null;

  return { header, payload, signature };
}

// Usage with a real JWT
const token = 'eyJhbGciOiJIUzI1NiJ9.eyJ1c2VySWQiOiIxMjM0NTY3ODkwIn0.signature_here';
const decoded = decodeJWTPayload(token);
console.log(decoded.header);  // { alg: 'HS256' }
console.log(decoded.payload); // { userId: '1234567890' }

Base64 Variant Comparison

Variant	Characters	Padding	URL-Safe	Email-Safe	Use Case
Standard Base64	A-Z a-z 0-9 + /	Yes (=)	No (+/ need encoding)	Yes	MIME email, data URIs
Base64URL	A-Z a-z 0-9 - _	Optional	Yes	No (-_ not MIME standard)	URLs, JWT tokens, query params
Base32	A-Z 2-7	Yes (=)	Yes	Yes	TOTP secrets, case-insensitive systems

Base64 Encoding Overhead

Input Size	Base64 Output	Base64URL Output	Base32 Output	Overhead
1 byte	4 chars (+ pad)	4 chars	8 chars (+ pad)	200-700%
3 bytes	4 chars	4 chars	8 chars	33-167%
16 bytes	24 chars	24 chars	32 chars	50-100%
32 bytes	44 chars	44 chars	52 chars	38-63%
64 bytes	88 chars	88 chars	104 chars	38-63%

Benefits

Supports all three major encoding variants: standard Base64, Base64URL, and Base32 with correct character sets.
Bidirectional encoding/decoding with accurate handling of padding characters across all formats.
UTF-8 safe — correctly handles multi-byte characters (emoji, CJK, accented letters) without mojibake.
Instant, client-side conversion with zero network requests — your data never leaves the browser.

Use Cases

Encoding JWT token headers and payloads for web authentication systems that use Base64URL format.

Embedding images and binary data as data URIs in HTML and CSS without external file references.

Transmitting binary data through text-only channels like email bodies, JSON APIs, and XML documents.

Decoding Base64-encoded configuration values, database fields, or API response parameters.

Common Mistakes to Avoid

✗

Using standard Base64 in URL query parameters — the + and / characters get misinterpreted as spaces and path separators.

✗

Forgetting that Base64URL padding is optional — some decoders fail if = is missing, while others accept it.

✗

Assuming Base64 is encryption — it is encoding, not encryption. Anyone can decode Base64 with no key.

✗

Applying Base64 to already-encoded data — double-encoding bloats output by 78% and produces garbage on decode.

Security Implications

Base64 is an encoding scheme, not encryption — it provides zero confidentiality. Anyone who intercepts Base64-encoded data can decode it instantly with no key. Never use Base64 to protect sensitive information like passwords, API keys, or personal data. Base64URL encoding in JWTs exposes the header and payload in plaintext; only the signature is verified, not encrypted. If you need to protect transmitted data, use TLS in addition to Base64 encoding.

Security Information

Frequently Asked Questions

What is the difference between Base64 and Base64URL?+

Why is Base64 not encryption?+

How do I handle padding in Base64URL?+

References & Further Reading

Try It Yourself

Encoding ≠ Encryption

Type any text below to see it encoded and decoded in real time. Notice how the original text is trivially recoverable — Base64 provides zero security.

Original Text

Base64 Encoded

—

Decoded Back

—

Security Test: The decoded output matches the original exactly. Anyone with the Base64 string can recover your "secret" in one step. Base64 is encoding, not encryption.

Important Limitations

Base64 Is Not Security

Not encryption

Base64 provides zero confidentiality. Anyone with the encoded string can decode it instantly. Use encryption (AES, RSA) for data protection.

Not compression

Base64 makes data larger, not smaller. It is designed for safe transport in text-based systems, not for reducing file size.

Do not store passwords as Base64

Storing a password as Base64 is functionally identical to storing it in plaintext. Always hash passwords with Argon2, bcrypt, or scrypt.

Fundamentals

What is Base64?

GeneratePass encodes Base64 using new TextEncoder().encode() to convert the input string to UTF-8 bytes, then maps each byte to a character via String.fromCharCode(), and passes the result to btoa(). Decoding reverses the process: atob() decodes the Base64 string, Uint8Array.from() converts back to bytes, and new TextDecoder().decode() restores the original UTF-8 string. This ensures emojis, accented characters, and non-Latin scripts are handled correctly without corruption.

The Base64 character set consists of uppercase letters A-Z, lowercase letters a-z, digits 0-9, and two symbols: plus (+) and forward slash (/). These 64 characters encode any binary value using printable ASCII.

Step-by-Step

How Base64 Encoding Works

Base64 encoding converts 3 bytes (24 bits) into 4 characters (each representing 6 bits). Each 6-bit value maps to a character in the Base64 alphabet. When input length is not divisible by 3, padding characters (=) are added. GeneratePass handles UTF-8 input by first encoding to bytes with TextEncoder, so multi-byte characters (like emoji 🎉) are correctly encoded as their byte sequences, not as individual characters.

Padding with =

When input is not evenly divisible by 3 bytes, padding (=) is appended. One = indicates 1 extra byte; two == indicates 2 extra bytes. The padded output always has a length divisible by 4.

Critical Distinction

Base64 vs Encryption

Base64 is an encoding format, not encryption. It does not use a secret key and is completely reversible. Anyone with the Base64 string can decode it instantly. Never use Base64 to protect sensitive data.

If you need to secure data, use proper encryption algorithms like AES-256-GCM. For data integrity, use SHA-256 hashing. Base64 is purely for data format conversion.

Applications

Use Cases

Email Attachments (MIME)

Binary attachments are Base64-encoded to safely travel through text-only email protocols.

Data URIs

Embed images and fonts directly in HTML/CSS using Base64-encoded data URIs.

JWT Tokens

JSON Web Tokens use Base64URL encoding for header and payload segments.

API Data Transport

Embed binary payloads in JSON or XML when the transport cannot handle raw bytes.

Pitfalls

Common Mistakes

Treating Base64 as Encryption

Base64 provides zero confidentiality. Anyone can decode it. Always use proper encryption for sensitive data.

URL Encoding Confusion

Standard Base64 uses + and / which are special in URLs. Use URL-safe Base64 (- and _) for query parameters.

Not Handling Padding

Always verify Base64 padding. Missing or extra = characters cause decoding errors.

Related Tools

Related Resources

Encoding

Base64 Encoder / Decoder

When Should I Use Base64?

Embedding images in HTML/CSS

Email attachments (MIME)

JWT token payloads

Transmitting binary data in JSON

Base64 Is NOT Encryption

Never use for passwords

Never use for encrypting sensitive data

Never use for hashing

What to Do After Encoding?

Embedding an image directly in CSS

What Base64 Encoding Does

The output is about 33% larger

Padding characters (=) are normal

Encoding ≠ Encryption

UTF-8 Safe Encoding

Introduction

What This Tool Does

Why It Matters

How It Works

Step-by-Step Examples

Code Examples

Base64 Variant Comparison

Base64 Encoding Overhead

Benefits

Use Cases

Common Mistakes to Avoid

Security Implications

Security Information

Frequently Asked Questions

References & Further Reading

Encoding ≠ Encryption

Base64 Is Not Security

Not encryption

Not compression

Do not store passwords as Base64

What is Base64?

How Base64 Encoding Works

Padding with =

Base64 vs Encryption

Use Cases

Email Attachments (MIME)

Data URIs

JWT Tokens

API Data Transport

Common Mistakes

Treating Base64 as Encryption

URL Encoding Confusion

Not Handling Padding

Related Resources

URL Encoder

SHA-256 Generator

Encoding Utilities