search⌘KtranslateENexpand_moreupload_fileConvert

Free Base64 Encoder & Decoder Online

Base64 encoder & decoder

Turn text into Base64 and back, live as you type. Handles emoji and any language, supports URL-safe output, and never sends your data anywhere.

lockEncodelock_openDecode

text23 bytes

swap_horiz

base6432 chars

SGVsbG8sIEZpbGVGb3JtZXIhIPCfkYs=

check_circle+39% sizecontent_copyCopy

URL-safe- _ instead of + /Paddingkeep trailing =Wrap at 76for email / MIME

Try:Hello worldEmoji 🚀Turkish textDecode a JWT part

~/bit-by-bit

How 3 letters become 4 characters.

Base64 takes your data 3 bytes (24 bits) at a time and re-cuts it into four 6-bit pieces. Each piece is a number from 0-63, looked up in a 64-character alphabet.

try

1 · your characters as bytes

C6701000011

a9701100001

t11601110100

south

2 · regrouped into 6-bit pieces

010000= 16southQ

110110= 54south2

000101= 5southF

110100= 52south0

“Cat” is exactly 3 bytes, so it maps cleanly to 4 characters: Q2F0.

+33%Always biggerEvery 3 bytes become 4 characters, so Base64 is about a third larger than the original.

64Safe charactersA: Z, a, z, 0-9, + and /, characters that survive email, JSON, URLs and old systems.

=PaddingMarks leftover bytes at the end. URL-safe variants often drop it.

~/where-youll-see-it

Six places Base64 shows up.

It exists to carry binary data through systems that only accept plain text.

imageImages inside HTML & CSS

Tiny icons embedded directly as data URLs, saving an extra request.data:image/png;base64,iVBORw0KGgo…

mailEmail attachments

MIME encodes every attachment as Base64, wrapped at 76 characters per line.Content-Transfer-Encoding: base64

keyJWT tokens

Each part of a JSON Web Token is URL-safe Base64: readable by anyone.eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiI0MiJ9

lockHTTP Basic auth

The username and password are joined and Base64-encoded in a header.Authorization: Basic dXNlcjpwYXNz

data_objectBinary in JSON APIs

JSON can’t hold raw bytes, so files and keys are sent as Base64 strings.{ "file": "JVBERi0xLjcK…" }

descriptionKeys & certificates

PEM files are Base64 between BEGIN and END lines.-----BEGIN CERTIFICATE-----

gpp_badcommon mistake

Base64 is not encryption.

Anyone can decode it instantly, there's no key. A password “hidden” in Base64 is effectively in plain sight. For secrets, use real encryption; for storing passwords, use a slow hash like bcrypt or Argon2.

config.ymldb_password: c3VwZXJzZWNyZXQxMjM=southdecoded in 1 ms: supersecret123

~/base16-to-base85

The same bytes in six binary-to-text encodings.

Base64 is one choice on a spectrum. A bigger alphabet means shorter output but more characters that can break in transit. Base32 survives case-insensitive systems and phone dictation, Base58 drops look-alike characters for wallet addresses, Ascii85 squeezes PDF and PostScript streams. Every row below is encoded live.

input text

encodingoutputlengthoverhead

Base16 (hex)RFC 4648 §848692C204261736536342122 chars+100%

Base32RFC 4648 §6JBUSYICCMFZWKNRUEE======24 chars+118%

Base58Bitcoin alphabetJxTDYGirc8pQuje15 chars+36%

Base64RFC 4648 §4SGksIEJhc2U2NCE=16 chars+45%

Base64urlRFC 4648 §5SGksIEJhc2U2NCE15 chars+36%

Ascii85Adobe, PostScript & PDF<~880Ut6=FqH2DcQ~>18 chars+27%

Base32 · 5 bits per charUppercase letters and 2-7 only, so it survives case-folding. Used for TOTP secrets, onion addresses and DNSSEC.Base58 · log₂58 ≈ 5.86 bitsNo 0, O, I or l and no punctuation, so it can be copied by eye and double-clicked as one word. Not a block code: it treats the input as one big number.Ascii85 · 4 bytes in 5 charsThe densest common text encoding at 25% overhead, with “z” for four zero bytes. Its alphabet includes quotes and backslashes, so it doesn’t fit in JSON or URLs.

~/canonical-or-not

Different strings can decode to the same bytes.

When the input isn’t a multiple of 3 bytes, the last character carries a few spare bits. RFC 4648 says encoders must set them to zero, but many decoders ignore them, so “SGk=” and “SGl=” both decode to “Hi”. Decoders also differ on missing padding and whitespace. That matters wherever Base64 strings are compared, cached or signed. The browser column uses this page’s own atob().

inputatob() herestrict RFC 4648bytes

SGk="Hi"canonical48 69

SGl="Hi"reject: spare bits not zero48 69

SGs="Hk"canonical48 6B

SGk"Hi"reject: length not a multiple of 448 69

SGk==throws InvalidCharacterreject: length not a multiple of 4-

SG k="Hi"reject: character outside alphabet48 69

SGk=SGk=throws InvalidCharacterreject: padding before the end-

SG-_throws InvalidCharacterreject: character outside alphabet-

row 2 · SGl=Non-zero spare bits

S010010G000110l100101

“l” is 37, binary 100101: its last two bits are 01, not 00. Most decoders throw them away and still return “Hi”, so two different strings mean the same bytes.

verified_userComparing tokens or signatures? Decode both and compare the bytes, or re-encode and check the string round-trips unchanged. Never compare the raw Base64 text.

~/spec-sheet

Base64, for reference.

The full 64-character alphabet with each value, the rules from RFC 4648 and the specifications that use Base64 in their own way.

A0B1C2D3E4F5G6H7I8J9K10L11M12N13O14P15Q16R17S18T19U20V21W22X23Y24Z25a26b27c28d29e30f31g32h33i34j35k36l37m38n39o40p41q42r43s44t45u46v47w48x49y50z51052153254355456557658759860961+62/63

StandardRFC 4648The Base16, Base32 and Base64 Data Encodings, 2006, obsoleting RFC 3548

AlphabetA: Z a, z 0-9 + /Values 0-63 in that order; = for padding

URL-safebase64url- and _ instead of + and /; padding optional where a specification says so

Size4 × ⌈n / 3⌉ chars33.3% overhead plus padding; MIME line breaks add about 2.6% more

Line length76 (MIME) · 64 (PEM)RFC 2045 and RFC 7468; RFC 4648 itself sets no limit

Padding= or ==One “=” after 2 leftover bytes, two after 1

Data URLsdata:[type];base64,…RFC 2397; the WHATWG fetch standard defines browser parsing

Browser APIbtoa() · atob()Latin-1 strings only; Uint8Array.toBase64() and fromBase64() are the newer byte-based methods

Not in JSONno binary typeBinary fields are usually Base64 strings, sometimes base64url

Variantscrypt · bcrypt · UTF-7 · IMAPSame idea, different alphabets or orderings; not interchangeable

1987Privacy-Enhanced MailRFC 989 defines a printable encoding for encrypted email, the direct ancestor of Base64.

1992MIMERFC 1341, later RFC 2045, makes Base64 the standard for email attachments, with 76-character lines.

1998Data URLsRFC 2397 lets small files be embedded in web pages as Base64.

2003RFC 3548The first standalone definition of Base16, Base32 and Base64, including base64url.

2006RFC 4648The current standard: canonical encoding and the rules for padding and invalid characters.

2015JWTRFC 7519 tokens use unpadded base64url for every part.

Sources

[1]RFC 4648The Base16, Base32 and Base64 data encodings.IETF ↗[2]RFC 2045 §6.8Base64 in MIME email, with 76-character lines.IETF ↗[3]RFC 7468Textual encodings of keys and certificates (PEM).IETF ↗[4]Forgiving-base64 decodeThe algorithm behind atob() in every browser.WHATWG Infra ↗[5]Uint8Array.prototype.toBase64()The newer byte-based Base64 API.MDN Web Docs ↗[6]RFC 2397The data: URL scheme.IETF ↗

More encoding tools

Different encodings for different places text has to travel.

All developer tools →

linkURL Encoder

Percent-encode text so it’s safe inside a URL or query string.

a b&carrow_forwarda%20b%26c

keyJWT Decoder

Decode the Base64 parts of a token to read its header and payload.

eyJhbG…arrow_forward{ "alg": "HS256" }

imageImage to Base64

Turn an image file into a data URL you can paste into HTML or CSS.

icon.pngarrow_forwarddata:image/png…

tagHash Generator

Create a fixed-length fingerprint of text: one-way, unlike Base64.

helloarrow_forward2cf24dba…

codeHTML Encoder

Escape characters like < and & so they display as text in HTML.

<b>arrow_forward<b>

data_objectJSON Formatter

Pretty-print API responses that contain Base64 fields.

{"a":1}arrow_forward{ "a": 1}