What Base64 is for
Base64 rewrites arbitrary bytes using 64 printable characters, so binary data can travel through something that only accepts text: an email body, a JSON string, a data URI, an HTTP header. Three bytes in become four characters out, which is why an encoded payload is always about 33% larger than the original.
It is not a security measure. Decoding needs no key, and this page proves it — if you can read the value, so can anyone else who has it.
How to use it
- Pick Encode or Decode.
- Paste your input on the left. The result appears on the right immediately.
- For a value that will end up in a URL or a JWT, switch on URL-safe.
Decoding accepts both alphabets and tolerates missing = padding, so you can
paste a JWT segment straight from a token without cleaning it up first.
The UTF-8 trap
The browser's own btoa() throws InvalidCharacterError on any character above
U+00FF. That is why so many hand-rolled encoders mangle Cyrillic, CJK and emoji.
The fix is to encode the text to UTF-8 bytes first and Base64 those bytes; this
tool does it in both directions, so Привет survives the round trip.
Where you will actually meet it
Authorization: Basicheaders, which areuser:passwordin Base64 — readable by anyone on the wire without TLS.- Data URIs:
data:image/png;base64,...for small inline assets. - The header and payload of a JWT, which are base64url — see the JWT decoder for reading those properly.
Questions
Is Base64 encryption?+
No, and this matters. Base64 is an encoding, not a cipher — anyone can reverse it with no key, including this page. It exists to move binary data through channels that only accept text. Never use it to hide a password or a token.
Why does the built-in btoa() break on Cyrillic or emoji?+
btoa() takes a string of single bytes and throws on any character above U+00FF. Text has to be converted to UTF-8 bytes first. This tool does that conversion in both directions, which is why 'Привет' and '🔧' round-trip correctly here and not in a bare btoa() call.
What is the URL-safe alphabet?+
Standard Base64 uses + and /, which both have meaning inside a URL, and = padding, which is awkward in a query string. The URL-safe variant (RFC 4648 §5) swaps them for - and _ and usually drops the padding. Decoding here accepts either form without you having to say which.
Can I decode a Base64 image or PDF?+
You can paste it, but the output pane shows text. If the bytes are not valid UTF-8 the tool says so rather than printing replacement characters — that message usually means you have a binary file, not broken input.