Base64 Encode / Decode

First, clear up a common misconception: Base64 is encoding, not encryption

Base64 is properly called "Base64 encoding" (a binary-to-text encoding). Its only job is to translate arbitrary binary data into text made of 64 printable characters. Many people first meeting this tool confuse it with encryption, and some even believe it can protect a password. That is a dangerous misunderstanding worth correcting up front. Encoding solves a compatibility problem for transport and storage: environments such as email, JSON, URLs and HTML restrict which characters are allowed, and raw binary bytes (an image, a zip file, non-ASCII text) would be corrupted by gateways, parsers or editors if inserted directly. So people first turn the bytes into plain text with Base64, then restore them exactly at the destination. The process uses no key and provides no confidentiality; anyone who obtains the Base64 string can recover the original content instantly. If what you actually need is to make data unreadable to others, you should use a real encryption algorithm such as AES or RSA, not Base64.

Another easily missed fact is that Base64 operates on bytes, not on characters or letters. For plain English ASCII text, one letter happens to be one byte, so the output looks like a one-to-one substitution. But as soon as non-ASCII characters such as Chinese text, emoji or Japanese appear, the situation changes completely: those characters are stored internally as UTF-8 multibyte sequences, where a common Chinese character usually takes 3 bytes and an emoji may take 4 bytes. Base64 first converts the whole text into a byte sequence according to UTF-8, then encodes those bytes. That is why encoding "你好" produces a long string of seemingly unrelated characters: the tool encodes the six underlying UTF-8 bytes, not the two glyphs "你" and "好" themselves.

The Base64 alphabet: 64 printable characters and their indices

The table below is the heart of Base64. Every encoded byte ultimately maps to one of these 64 characters. Indices are numbered consecutively starting from 0; encoding is essentially renumbering the binary data in 6-bit groups and then looking up each number in this table.

How to read this table: two details matter. First, uppercase A has index 0 rather than 1, which means Base64 is essentially a "renumbering in 6-bit units". Second, the last two characters of standard Base64 are + and /; although printable, they are not "safe" in certain environments, which is exactly why the URL-safe variant described later exists.

Padding rules: why an equals sign appears at the end

Base64 always processes 3 bytes at a time (24 bits), which split neatly into 4 groups of 6 bits and yield 4 characters. But the original data length is seldom a multiple of 3, so when the tail cannot fill a group, an equals sign = is used as padding:

How to understand the equals sign: the = is not one of the 64 alphabet characters; it is merely a placeholder telling the decoder "this group is incomplete, a few bytes are missing at the end". Crucially, padding carries no actual data; removing or misplacing it does not change the real content, it only makes the decoder reject or truncate the tail. This is also why the same content sometimes appears with or without equals signs in different tools: as long as both sides agree on whether to keep padding, the encoded result is equivalent.

The URL-safe variant: swap + and / for - and _

In standard Base64, + and / have special meaning inside URLs and file names (+ is often treated as a space, / is a path separator), so dropping them into a link would be misparsed. The URL-safe Base64 defined in RFC 4648 section 5 replaces these two characters:

How to choose: URL-safe and standard Base64 differ only at the character level; the encoded information is completely equivalent, and converting between them does not change the decoded result. If you need to put Base64 into a link, a cookie or a file name, always use the URL-safe variant; if you are embedding it in a JSON field or a Data URI, the standard version is fine. Note that swapping characters is not encryption: anyone can convert - and _ back to + and / and decode normally.

Worked examples: computing Base64 step by step

Example 1: the word Man. It contains three bytes: M=77, a=97, n=110. Write them in binary: M=01001101, a=01100001, n=01101110; concatenate in order into 24 bits: 01001101 01100001 01101110. Split into 6-bit groups: 010011=19 maps to T, 010110=22 maps to W, 000101=5 maps to F, 101110=46 maps to u. So Man encodes to TWFu. Because it is exactly 3 bytes, there is no remainder and no trailing equals sign. You can verify by typing Man into this tool; the result should match exactly.

Example 2: the word Hello. It contains five bytes: H=72, e=101, l=108, l=108, o=111, for 40 bits in total. Grouped by 6 bits, the first 36 bits give S, G, V, s, b, G; the remaining 4 bits 1111 are short of a group, so two zeros are appended to make 111100=60 maps to the character 8. Because only one byte is missing at the end (5 divided by 3 leaves remainder 2), one equals sign is appended. The final result is Hello maps to SGVsbG8=. Type Hello into this tool to confirm.

Frequently asked questions (Base64 specific)

Why does an equals sign (=) appear at the end of the encoded result? Because Base64 processes 3 bytes at a time into 4 characters; when the original length is not a multiple of 3, the missing bytes at the tail are filled with equals signs. One missing byte gets one =, two missing bytes get two =. The equals sign is only a format placeholder and carries no data, but it usually must be kept during decoding to correctly restore the byte length.

What is the difference between URL-safe and standard Base64, and when should I use each? The standard version uses + and / as its last two characters, but both have special meaning in URLs, file names and query parameters and would be misparsed if inserted directly. The URL-safe variant replaces + with - and / with _, and usually omits the trailing equals sign. Use the URL-safe variant when the output must go into a link, a cookie or a file name; use the standard version when embedding in JSON or a Data URI.

Is Base64 an encryption algorithm? Can it protect passwords or sensitive data? No. Base64 is only an encoding with no key and no confidentiality; anyone who gets the string can recover the original instantly. It cannot replace encryption. When real confidentiality is needed, use a standard encryption algorithm such as AES or RSA instead of obscuring data with Base64. Storing or transmitting a password that is merely Base64-encoded is effectively exposing it in plaintext.

How are non-ASCII characters such as Chinese text encoded in Base64? Base64 operates on bytes, not glyphs. Non-ASCII characters such as Chinese text or emoji are first converted into a UTF-8 byte sequence (a common Chinese character usually takes 3 bytes, an emoji may take 4) and then encoded in 6-bit groups. That is why encoding "你好" produces a longer string: the tool encodes the six underlying UTF-8 bytes rather than the two glyphs. Using UTF-8-safe encoding and decoding (such as the browser's standard TextEncoder and TextDecoder) ensures Chinese text survives the round trip without corruption.

Base64 versus Base16 and Base32

Base64 is one member of a small family of base encodings, and the others are worth knowing when you choose a format for a task. Base16, which is better known as hexadecimal, uses sixteen characters, the digits zero through nine and the letters A through F, and it expands data by a factor of two, because each byte becomes exactly two characters. Base32 uses thirty two characters, typically the letters A through Z and the digits two through seven, and it expands data by a factor of about one point six, while deliberately avoiding characters that look alike, such as the digit zero and the letter O. Base64 is the most compact of the three printable text encodings, with the smallest overhead, which is why it is the default choice for most web and email work. The trade off is that Base64 output can include plus, slash, and equals, which are not safe in every context, whereas Base32 is often preferred when a human must read or type the result, because it steers clear of those ambiguous symbols.

How the bit grouping produces the exact output length

The length of any Base64 string follows a simple, predictable formula, and you can compute it by hand without a calculator. Take the number of input bytes, divide by three, and round up to the next whole group, because each group of three bytes becomes four characters. Then multiply the number of groups by four, and that is your character count, before you consider padding at all. A string of four bytes, for example, forms one complete group of three plus one leftover byte, so it needs two groups in total, which is eight characters, and the second group is padded with two equals signs. A string of five bytes, similarly, needs two groups, eight characters, and exactly one equals sign. A string of six bytes divides exactly into two groups, eight characters, with no padding at all. Keeping this formula in mind helps you sanity check a result, and it explains why the length of encoded output always ends in a four, an eight, or a multiple of four plus some padding.

Binary data, not just text, can be encoded

Although this tool accepts text in its input box, Base64 itself is defined over raw bytes, and any byte sequence can be encoded, whether or not it represents readable text to a person. An image file, a PDF document, a private key, or a compressed archive is just a stream of bytes, and each of those bytes can be turned into the Base64 alphabet exactly the way the bytes of a sentence are turned. This is why Base64 is the standard way to embed a small image inside a web page, or to attach a file to an email, or to carry a certificate inside a configuration file. The catch is that decoding Base64 that came from binary data gives you back the original bytes, not text, so you must then save those bytes to a file, or interpret them with the correct format, rather than printing them as characters on screen. Treating decoded binary as text is a common, and avoidable, source of corrupted downloads and broken files.

Line breaks and wrapping in Base64 output

Some systems insert line breaks, often every seventy six characters, into long Base64 strings, following the original MIME convention that was written for email. Those line breaks are not part of the data, and a strict decoder may reject them, while a tolerant decoder simply ignores them as whitespace. When you copy a Base64 string from an email, a certificate, or a log file, you may therefore bring invisible newlines along with it, and those newlines can cause a decode to fail, or to produce the wrong output. The safe habit is to remove all whitespace from the string before decoding, or to use a decoder, such as this tool, that strips whitespace for you automatically. The output of this tool is produced without any inserted line breaks, so it is ready to paste directly into code, into a URL, or into an API field without further cleanup of any kind.

Base64 and security: what it does and does not give you

It is worth stating the security point plainly, because confusion here leads to real breaches in production systems. Base64 provides no confidentiality, no integrity, and no authentication, which means it should never be mistaken for encryption of any kind, weak or strong. A password that is merely Base64 encoded is, for all practical purposes, a plaintext password, because decoding it takes a single step and requires no secret at all. Sensitive data that must be protected should be encrypted with a vetted algorithm, such as AES for data at rest or TLS for data in transit, and then, if needed, Base64 can be used only to make the encrypted bytes transportable as text. Likewise, a Base64 string cannot prove who created it or whether it was changed in transit, because anyone can produce a valid Base64 string from any input, so for real trust you need a signature, or a message authentication code, layered on top of the encoded data.

A short practical checklist before you copy a result

Before you rely on a Base64 result, a few quick checks prevent most of the mistakes that people make. Confirm that the alphabet matches the destination, choosing standard Base64 for JSON and Data URIs and URL-safe Base64 for links and file names. Confirm that padding is handled the way the receiver expects, keeping or removing equals signs as the interface requires. Remove stray whitespace and line breaks that you may have copied from another source by accident. Verify the text encoding, using UTF-8 on both ends whenever the input contains non-English characters of any kind. And remember that the output is larger than the input by about a third, so budget for that growth inside any size limit you face. Following these checks takes a moment and avoids the majority of Base64 related bugs that appear in real projects under real deadlines.

Base64 at a glance: a compact factual rundown

Base64, was, first, described, in, RFC, 1421, then, refined, in, RFC, 2045, and, finalized, in, RFC, 4648, the, standard, alphabet, holds, sixty, four, characters, the, url, safe, variant, swaps, plus, for, minus, and, slash, for, underscore, padding, uses, the, equals, sign, a, valid, string, has, length, divisible, by, four, decoding, needs, no, key, encoding, needs, no, key, the, scheme, is, reversible, the, scheme, is, deterministic, the, same, input, yields, the, same, output, binary, data, of, any, kind, encodes, fine, images, and, archives, are, just, bytes, mime, email, uses, Base64, for, attachments, pem, files, use, Base64, with, headers, basic, auth, sends, credentials, as, Base64, json, web, tokens, carry, base64url, payloads, the, browser, api, btoa, fails, on, unicode, text, because, it, expects, latin, one, bytes, the, modern, api, TextEncoder, handles, utf, eight, correctly, data, uris, inline, small, images, into, pages, large, inlined, images, bloat, the, page.

the, output, grows, by, about, a, third, compression, stays, absent, encryption, stays, absent, integrity, stays, absent, confidentiality, stays, absent, only, transport, safety, improves, utf, eight, must, match, on, both, ends, mixed, encodings, cause, mojibake, this, tool, uses, utf, eight, consistently, this, tool, strips, whitespace, automatically, this, tool, reports, clear, decode, errors, line, wrapping, at, seventy, six, columns, is, a, mime, habit, strict, decoders, reject, stray, whitespace, tolerant, ones, ignore, it, the, equals, sign, is, not, case, sensitive, the, letters, are, case, sensitive, canonical, encoding, removes, ambiguity, for, stored, keys, streaming, encoders, chunk, data, to, bound, memory, a, base64, string, is, safe, to, log, never, safe, to, trust, with, secrets, mislabeling, it, as, encryption, causes, real, breaches, training, teams, on, the, difference, prevents, incidents, planning, storage, must, count, the, overhead, a, one, megabyte, file, becomes, about, one, point, three, three, megabytes, encoded.

base64url, omits, padding, by, default, some, systems, also, omit, padding, re, adding, padding, is, always, safe, a, correct, decoder, rejects, unknown, characters, at, once, some, libraries, accept, both, alphabets, together, which, weakens, validation, the, canonical, form, keeps, output, stable, hashing, base64, needs, a, fixed, form, base64, inside, a, database, uses, more, space, than, a, binary, blob, this, trade, off, is, common, but, costly, at, scale, decoding, by, hand, is, a, fast, way, to, debug, auth, issues.

If you also need to handle special characters inside URL parameters, pair this tool with the URL Encode/Decode tool. To clean hidden whitespace and zero-width characters copied from web pages or chat logs, use the Text Cleaner first. And to extract plain text from HTML source, see the HTML Stripper.