Base64 Encoder / Decoder

Base64 is an encoding scheme that converts binary data into a text format using 64 printable ASCII characters: A–Z, a–z, 0–9, +, and /. It was invented to safely transmit binary data (images, files) through systems designed only for text, like email (MIME). Common uses today: embedding images directly in HTML/CSS as data URIs (data:image/png;base64,...), encoding binary attachments in emails, passing data through JSON APIs that only accept strings, HTTP Basic Authentication (Authorization: Basic dXNlcjpwYXNz), and storing binary data in databases. Base64 increases data size by about 33%.

Standard Base64 uses + and / which have special meaning in URLs (+ means space, / separates path segments). URL-safe Base64 (RFC 4648 Section 5) replaces + with - and / with _, making the output safe to include directly in URLs and filenames without percent-encoding. The = padding characters can also be removed since the length is usually known in context. URL-safe Base64 is used in JWT (JSON Web Tokens), OAuth 2.0 PKCE, URL shorteners, file naming, and any context where the Base64 string appears in a URL. Toggle the URL-safe checkbox above to use this variant.

No. Base64 is an encoding, not an encryption. Anyone can decode a Base64 string instantly — there is no key, no password, and no secret involved. It provides zero security. Seeing SGVsbG8gV29ybGQ= decoded immediately to Hello World illustrates this clearly. Base64 only converts binary data to a text-safe format for transmission. For actual security, use encryption algorithms like AES-256 or RSA on top of Base64 if needed. Never use Base64 alone to "hide" or "protect" sensitive information like passwords, tokens, or personal data.

Base64 works by taking 3 bytes (24 bits) of input at a time and splitting them into four 6-bit groups. Each 6-bit group (values 0–63) maps to a character in the Base64 alphabet. Since there are only 64 characters needed, any printable ASCII subset works. If the input length is not divisible by 3, padding = or == is added. Example: "Man" (0x4D 0x61 0x6E = 01001101 01100001 01101110) becomes four 6-bit groups: 010011 010110 000101 101110 = indices 19, 22, 5, 46 = "TWFu". This is why Base64 output is always about 4/3 (≈133%) the size of the input.

A data URI (or data URL) embeds file content directly into HTML or CSS using the format data:[mediatype];base64,[data]. Example: <img src="data:image/png;base64,iVBOR...">. This eliminates an HTTP request for that resource. Use cases: embedding small icons, logos, or background images in CSS to reduce HTTP requests; embedding assets in email HTML where external URLs may be blocked; single-file HTML documents that include all assets. Avoid for large files: a 100KB image becomes ~133KB in Base64, and the browser cannot cache it separately. Best used for assets under 5–10KB. This tool generates the data URI automatically when you drop an image file.

Browser JavaScript: btoa(text) encodes a string to Base64, atob(base64) decodes it. Important: btoa() only handles Latin-1 characters. For Unicode/UTF-8 strings: btoa(unescape(encodeURIComponent(str))) to encode, and decodeURIComponent(escape(atob(b64))) to decode. In Node.js: Buffer.from(text).toString('base64') to encode, Buffer.from(b64, 'base64').toString('utf8') to decode. For URL-safe Base64 in Node.js, use base64url package or replace + with -, / with _, and remove = padding manually.

Base64 encodes 3 bytes into 4 characters. If the input length is not a multiple of 3, one or two = characters are appended to make the output length a multiple of 4. One = means 1 byte of padding; == means 2 bytes. The padding makes the length unambiguous for decoders. Padding can be safely omitted when the length is known from context — for example, in JWT tokens and URL-safe Base64, the = is typically stripped since the parser knows the total length. The "No padding" checkbox above removes the trailing = characters. Most modern decoders can handle unpadded Base64, but some strict implementations require padding.

MIME (RFC 2045) Base64 requires that encoded output be wrapped at 76 characters per line with CRLF (\r\n) line endings. This originated from limitations in early email software and telecommunications that could not handle very long lines. Modern systems generally do not require line wrapping, but it is still standard in PEM-encoded certificates and some email contexts. The "Line wrap" selector above lets you choose 64 characters (PGP/SSH standard), 76 characters (MIME email standard), 128 characters, or no wrapping. For most web and API uses, no wrapping is preferable.

Drop your image file on the drop zone above. The tool encodes it to Base64 and generates a complete data URI in the Data URI section below the output. Copy it and use directly in CSS: background-image: url('data:image/png;base64,iVBOR...');. Or in HTML: <img src="data:image/svg+xml;base64,PHN2Zy...">. For SVG files, you can often embed them without Base64 by URL-encoding the SVG text: url("data:image/svg+xml,%3Csvg..."). Base64 images increase HTML/CSS file size and disable browser caching for that asset separately, so use them only for very small images (icons under 1–2KB).

Base32 uses 32 characters (A–Z, 2–7) and is case-insensitive, producing larger output (60% overhead) but safer for case-insensitive contexts like TOTP authentication codes (Google Authenticator). Base58 (used in Bitcoin addresses) removes visually similar characters (0, O, I, l) to avoid human transcription errors. Base85 (Ascii85) uses 85 characters for 25% overhead vs Base64's 33%, used in PDF and PostScript. Base64 is the universal standard for web and email because its 33% overhead is acceptable and it is natively supported in all browsers and most languages. This tool handles standard Base64 and URL-safe Base64 (RFC 4648).