Base64 Encode and Decode

What Base64 is for

Base64 turns any sequence of bytes into letters, digits, plus and slash so it can travel through systems that only accept text: JSON, HTML, email, and environment variables. It is not encryption. Anyone can reverse it. Use it when you need a safe text form of a file, a UTF-8 string, or a small image, not when you need to hide a secret.

This page encodes and decodes in the browser. The character encoding menu decides which bytes the text becomes. UTF-8 is the default, and it is what modern APIs expect for Chinese, emoji and accented letters. Pick GBK, Big5, Shift_JIS or UTF-16 when the other system is older. Hex means the box is already hexadecimal bytes, so you can turn Base64 into hex and back. A file is read as raw bytes and ignores that menu, so a PNG or PDF stays intact. Nothing is uploaded.

• Standard alphabet uses + and /, with = padding. That is the form used by MIME and most programming libraries.
• URL-safe alphabet swaps those for - and _ and drops padding, which is what JWT segments and many query strings use.
• 76-character lines match the MIME line length. Turn line breaks off when you are pasting into JSON.
• Data URI prefixes the result so it can sit in an img or CSS url(). For a real image, encode the file, not the filename.

How to use it

1. Paste text, or choose a file. A file replaces the text box and is encoded as bytes.
2. Choose Encode or Decode, then the character encoding. Decoding accepts standard and URL-safe input, and it ignores spaces and line breaks. Hex decoding prints the bytes as hex instead of letters.
3. For encoding, pick the alphabet and whether to wrap lines. Check “Add a data URI prefix” only when the next step is HTML or CSS.
4. Leave “Update as you type” on for short strings. For a large file, the result appears when the file finishes reading.
5. Copy the result or download it as a text file. If decoding fails, the string was cut off or it is not Base64.

Rules this page follows

Every three bytes become four characters. If the input length is not a multiple of three, the output is padded with = so the length is a multiple of four. URL-safe mode removes that padding; the decoder puts it back.

A data URI such as data:text/plain;base64,aGVsbG8= is accepted on decode: the header is stripped and only the payload is decoded. Whitespace inside the payload is ignored, which is why an email body with 76-character lines still decodes.

The character encoding changes the bytes before Base64 is applied. The two characters 中文 are six bytes in UTF-8 and four bytes in GBK, so the Base64 strings differ. If another tool disagrees, match its encoding, or switch this page to Hex and compare the bytes. Related tools: string to bytes and URL encode.

Where people actually use it

• Putting a small file into a JSON API that has no multipart upload.
• Reading a Basic authentication header, which is the word Basic, a space, then Base64 of user:password.
• Checking a JWT payload. Split on the dots and decode the middle segment with URL-safe mode. Do not treat that as a signature check; use the hash tool only for checksums, not for verifying JWT signatures.
• Embedding an SVG or icon in a stylesheet when a separate request is not worth it.

Questions