Base64 Encoder and Decoder

Standard or URL-safe, with UTF-8 handled properly — accents and emoji survive the round trip.

In-browser & private
Advertisement

Decoding accepts either alphabet and missing padding, so a JWT segment pasted straight from a header just works — and nothing you paste leaves the page, which is what makes that safe.

Plain text
Base64
Bytes in — Base64 chars — Overhead — Ready

The parts that trip people up

  • Base64 encodes bytes, not text. "Base64 of a string" is meaningless until you say which encoding — this uses UTF-8, so é is two bytes and an emoji is four. A browser's raw btoa throws on both, which is why it is not used here directly.
  • URL-safe is a different alphabet, not a different algorithm. + and / become - and _ so the result survives a query string. JWTs use it, unpadded.
  • It is not encryption. Anyone can decode it. It exists to move bytes through a text-only channel, and a Base64 password is a plaintext password.

Decoding a token rather than a payload? The JWT decoder splits the three segments and reads the claims for you.

// Java
String b64 = Base64.getEncoder().encodeToString(s.getBytes(StandardCharsets.UTF_8));
byte[] back = Base64.getDecoder().decode(b64);

// URL-safe, unpadded - what a JWT segment looks like
String url = Base64.getUrlEncoder().withoutPadding().encodeToString(bytes);

Frequently asked questions

Is anything I paste uploaded?
No. Encoding and decoding both run in your browser, and a file you choose is read in the page rather than sent anywhere. That is what makes it safe to paste a token here — though a token you have pasted anywhere should still be treated as one you need to rotate.
Why does my accented text work here but break in my code?
Because Base64 encodes bytes, and a string only becomes bytes once you choose an encoding. This page uses UTF-8, so é is two bytes. JavaScript's btoa assumes Latin-1 and throws on anything above U+00FF, which is the usual cause. In Java, call s.getBytes(StandardCharsets.UTF_8) rather than s.getBytes().
Can I decode an image or a data URI?
Yes. Paste a whole data:image/png;base64,… string and the prefix is recognised. When the bytes are not text they are shown as a hex preview and the Download bytes button saves them exactly as they are. Encode a file goes the other way.
When do I need URL-safe Base64?
When the result travels in a URL, a query string or a filename, because + and / mean something there. It is the same algorithm with two characters swapped for - and _. JWTs use it, which is why decoding here accepts either alphabet and missing padding. In Java that is Base64.getUrlEncoder().withoutPadding().
Does Base64 protect anything?
No. It is not encryption and it is not a hash. Anyone can decode it, this page included. It exists to carry bytes through a channel that only accepts text, so a Base64 password is a plaintext password with an extra step.

More free tools