Base64 Encoder/Decoder - Base64 Encoding and Decoding

No. Base64 is encoding, not encryption. Anyone who sees a Base64 string can decode it to the original data in milliseconds without any password or key. Base64 provides zero confidentiality or security. It is purely a format conversion to make binary data safe for text-based systems. If you need to actually protect data from being read, use AES encryption instead. The confusion arises because Base64 output looks like random characters — but it is completely reversible without any secret.

Standard Base64 uses + and / characters, which have special meanings in URLs (+ means space, / separates path segments). URL-safe Base64 (also called Base64url) replaces + with - and / with _, making the output safe to use in URLs and file names without percent-encoding. You typically need URL-safe Base64 for JWT tokens, OAuth state parameters, URL shorteners, and file names generated from hashes. Most APIs that claim to use "Base64" in URLs actually use Base64url.

Text input supports all Unicode characters — emojis, CJK, Arabic, Cyrillic, and every other character set via UTF-8 encoding. For files, upload anything up to 10 MB: images (PNG, JPEG, WebP), documents, binary data, zip archives. The file is read as raw bytes and encoded, so the output is a valid Base64 representation of the entire file regardless of its content type.

Base64 always adds approximately 33% size overhead. This happens because 3 input bytes (24 bits) become 4 output characters (32 bits). A 1 MB image becomes roughly 1.33 MB Base64. Additionally, Base64 strings often have line breaks added every 76 characters per MIME standard, adding a small amount more. For small assets (under 5 KB) the overhead is worth eliminating an HTTP request by inlining as a Data URI. For larger files, serve them separately.

Yes. Upload any image and the Base64 output can be used directly as a Data URI by prefixing it with data:image/png;base64, (adjust the MIME type for JPEG or WebP). For example: <img src="data:image/png;base64,iVBOR...">. This embeds the image directly in HTML or CSS without a separate file request. Useful for small icons, email templates where external images may be blocked, and offline HTML documents.

A JWT has three parts separated by dots: header.payload.signature, each part being Base64url-encoded. You can paste any individual part (header or payload) into this decoder and read the JSON inside. However, this tool does not verify the JWT signature — for JWT signature verification, use a dedicated JWT decoder tool. The header and payload of any JWT can be read by anyone who has the token, since they contain only encoded (not encrypted) data.

No. All encoding and decoding happens in your browser using JavaScript's built-in btoa() and atob() functions (for text) and FileReader API (for files). Nothing is sent to any server. You can safely encode API keys, private data, and sensitive files without any privacy concerns.