Base64Encoder Decoder

Standard or URL-safe, with UTF-8 handled properly — accents and emoji survive the round trip.

In-browser & private
Advertisement

Decoding accepts either alphabet and missing padding, so a JWT segment pasted straight from a header just works — and nothing you paste leaves the page, which is what makes that safe.

Plain text
Base64
Bytes in — Base64 chars — Overhead — Ready

The parts that trip people up

  • Base64 encodes bytes, not text. "Base64 of a string" is meaningless until you say which encoding — this uses UTF-8, so é is two bytes and an emoji is four. A browser's raw btoa throws on both, which is why it is not used here directly.
  • URL-safe is a different alphabet, not a different algorithm. + and / become - and _ so the result survives a query string. JWTs use it, unpadded.
  • It is not encryption. Anyone can decode it. It exists to move bytes through a text-only channel, and a Base64 password is a plaintext password.
// Java
String b64 = Base64.getEncoder().encodeToString(s.getBytes(StandardCharsets.UTF_8));
byte[] back = Base64.getDecoder().decode(b64);

// URL-safe, unpadded - what a JWT segment looks like
String url = Base64.getUrlEncoder().withoutPadding().encodeToString(bytes);

More free tools