Base64 Encoder & Decoder
Encode text or files to Base64 and decode it back — Unicode-safe, URL-safe alphabet, optional padding, data URLs, hex output and image preview. Runs locally.
Drop a file on this pane to encode it · ⌘/Ctrl+Enter runs manually · live mode pauses above ~2 MB
Two directions, zero surprises
The Encode / Decode toggle is the only mode — everything updates live as you type. Encode turns text (UTF-8, so emoji and CJK survive) or a dropped file into base64. Decode turns base64 back into bytes: valid UTF-8 shows as text, binary shows as hex and — when the magic bytes say it’s a PNG, JPEG, GIF, WebP or BMP — renders an actual preview. ⇄ Swap moves the output into the input and flips direction, the fastest way to check a round-trip or chain encode→decode.
Options that match how base64 is actually used
Alphabet — standard +/ (RFC 4648 §4) or URL-safe -_ (§5, “base64url”). Use URL-safe for anything that lives in a URL query, a filename, or a JWT. Padding toggles the trailing = — required by strict parsers, omitted by JWTs and safe to drop when the length is self-evident. Output picks raw base64, a data:<mime>;base64, URL ready to paste into img src or CSS, or hex when you’d rather inspect the bytes. In Decode, Show as controls how the decoded bytes are displayed — auto shows text only when it’s genuinely valid UTF-8, never mojibake.
A decoder that’s forgiving — and honest about it
Real-world base64 arrives dirty: wrapped at 76 columns by email, at 64 by PEM, missing its padding, wearing a data: prefix, or in the wrong alphabet. The decoder strips whitespace, accepts both alphabets, removes the data-URL prefix (percent-encoded payloads included), tolerates missing or miscounted = — and reports every one of those repairs in the status line rather than silently guessing. What it won’t swallow: characters outside the alphabet, = in the middle of the data, or a length ≡ 1 (mod 4) — that’s mathematically impossible in base64 and means your string was truncated. Errors point at the exact character.
Where each format actually lives
Base64 in Authorization: Basic headers, email attachments, data: URLs and JSON fields carrying binary. Base64url in JWTs, URL tokens and filenames. Hex in hashes, fingerprints and key material. If you’re choosing, base64 vs base64url vs hex is the full comparison; what base64 is covers the encoding math; data URLs covers their limits and the bug guide covers the btoa Unicode trap and the 76-column wrap.
Everything runs on your device — the file never touches a network, and the tool works identically offline once loaded.
Frequently asked questions
Does anything I paste or upload leave my device?
No. This page is a static file; encoding, decoding, file reading and the preview all run in JavaScript inside your browser tab. You can load the page, go offline, and everything still works — that's the honest test, since pasted data often contains tokens and certificates. The privacy policy has the small print.
Why do other tools break on my Chinese text or emoji?
Most quick tools call btoa(text) directly. btoa takes a binary string — one byte per character — and throws InvalidCharacterError on any code point above U+00FF, which is every accented letter, every CJK character and every emoji. This tool converts text to UTF-8 bytes first (TextEncoder) and decodes with TextDecoder, so 👋 correctly becomes 8J+Riw== and back. Details in the common-bugs guide.
Standard or URL-safe — which alphabet should I use?
Standard (RFC 4648 §4) uses + and / as the last two characters; URL-safe (§5, "base64url") swaps them for - and _. Pick URL-safe anywhere the string lands in a URL query (+ is decoded as a space there), a filename, or a JWT — JWTs are base64url by spec. The decoder accepts both alphabets in the same paste and tells you which it saw. Full comparison in base64 vs base64url vs hex.
What does the padding (=) option do?
Padding completes the final group so the output length is a multiple of 4: one leftover byte gets ==, two leftover bytes get =. Strict parsers (Go's StdEncoding, PEM) require it; JWTs omit it by spec; most decoders cope either way. Turn it off for URL parameters and JWT-shaped output, on for files and email-shaped output. The decoder tolerates missing and miscounted padding — and says so when it fixes it.
Why is the output about 33% bigger than the input?
Every 3 bytes become 4 base64 characters (24 bits → 4×6 bits), so the size formula is 4·⌈n/3⌉ characters — exactly +33.3% when n is a multiple of 3, a bit more after rounding otherwise. The stats line above shows the real percentage for your input. The what is base64 article walks the math byte by byte.
Can I paste a full data URL or wrapped PEM-style base64?
Yes — a pasted data:<mime>;base64,... URL is detected automatically: the prefix is stripped, the MIME type is reported, and the payload is decoded. Whitespace is stripped too, so base64 wrapped at 76 columns (email style) or 64 columns (PEM style) decodes as-is. A percent-encoded data URL (data:... without ;base64) is decoded as bytes as well.
What does the file button do in each direction?
In Encode it reads the file's bytes and produces base64 or a ready-to-paste data URL with the file's real MIME type. In Decode it reads the file as text — the common case is a .b64/.txt file full of base64 — and decodes it. To get a file back out of base64, decode then press Download: the extension is sniffed from the magic bytes (png, jpg, pdf, zip, …).
What is the hex option for?
Hex (base16) shows the raw bytes — two characters per byte, so exactly double the size of the binary. It's how you compare decoded signatures, hashes and key material where characters like + vs - would confuse the eye. Encoding to hex works from text or a file; in Decode, pick Hex bytes under Show as (auto mode switches to it whenever the bytes aren't valid UTF-8 text).
Latest articles
Common Base64 Bugs: the btoa Unicode Trap, Line Wraps & Padding
btoa throwing on é, PEM's 64-column wrap vs MIME's 76, padding that strict parsers demand and JWTs drop — the seven base64 bugs that waste real debugging hours.
Base64 vs Base64URL vs Hex: Same Bytes, Three Alphabets
Only two characters differ between base64 and base64url — but they decide whether your string survives a URL, a filename or a JWT. Plus when plain hex beats both.
Data URLs: What They Are, When to Use Them, and Their Limits
An entire file inside a URL: how data: URIs work, where they shine (icons, canvas exports, downloads), and the limits that make them the wrong tool for big assets.
What Is Base64? The Encoding, the Math, and Why It's Everywhere
The 64-character alphabet, the index table, the 3→4 byte math behind the famous +33% overhead, and where base64 still earns its keep.