Base64 is a binary-to-text encoding scheme that represents arbitrary bytes using a 64-character alphabet of printable ASCII. It is ubiquitous in places where data needs to survive systems that were originally designed for text only: email attachments, HTTP Basic auth headers, JSON payloads carrying binary blobs, and data URIs embedded in HTML and CSS. This tool encodes and decodes text or files entirely in your browser — the bytes never leave your machine.

How Base64 works

The algorithm walks the input three bytes at a time. Three bytes is 24 bits, which splits cleanly into four 6-bit groups. Each 6-bit group has 64 possible values (0–63), and each value maps to a fixed character:

Range	Characters
0–25	`A`–`Z`
26–51	`a`–`z`
52–61	`0`–`9`
62	`+`
63	`/`

When the input length is not a multiple of three, the encoder pads the final group with zero bits and appends = characters so the output length is always a multiple of four. One missing byte produces one =; two missing bytes produce two ==.

Because four characters encode three bytes, Base64 expands the data size by 4/3 (≈33%) plus a tiny amount for padding. Encoding a 1 KB file produces roughly 1.37 KB of text.

Standard vs. URL-safe Base64

The standard alphabet uses + and /, which have special meanings in URLs and filenames. URL-safe Base64 (RFC 4648 §5) swaps them:

+ becomes -
/ becomes _
Padding = is often dropped

JSON Web Tokens, JWKs, Webcrypto, and most REST APIs that embed Base64 in URLs use the URL-safe variant. Decoders for the two alphabets are not interchangeable — passing a standard Base64 string to a URL-safe decoder (or vice versa) will fail on any string containing +, /, -, or _.

Common use cases

Data URIs — inline a small image or font in HTML or CSS: background: url("data:image/png;base64,iVBORw0KGgo..."). Useful for icons, but wasteful for anything above a few kilobytes because it skips browser caching.
HTTP Basic authentication — the Authorization: Basic <token> header is the Base64 of username:password. It is not encrypted; anyone who captures the header trivially recovers the credentials. Always pair Basic auth with TLS.
Email attachments (MIME) — SMTP originally only supported 7-bit ASCII, so any binary attachment (PDF, JPEG) is transported as Base64.
Binary in JSON or XML — APIs that need to ship bytes (images, cryptographic keys, Protobufs) inside a JSON field rely on Base64 because JSON has no native binary type.
JSON Web Tokens — every JWT is three URL-safe Base64 segments joined by dots: header.payload.signature.

Worked example

The ASCII string cat is the three bytes 0x63 0x61 0x74.

Concatenated bits: 01100011 01100001 01110100
Split into four 6-bit groups: 011000 110110 000101 110100
As decimal: 24 54 5 52
Mapped to the alphabet: Y, 2, F, 0
Result: Y2F0 — no padding needed because the input was a multiple of three.

For the two-byte input ca (0x63 0x61):

Bits: 01100011 01100001, padded to 18 bits.
Three 6-bit groups plus one padding unit: 011000 110110 000100 (last group is padded with zero bits on the right).
Mapped: Y, 2, E, plus = for the missing fourth character.
Result: Y2E=.

Base64 is encoding, not encryption

This cannot be repeated enough: Base64 is reversible by anyone, instantly, without a key. It exists to make bytes safe to transport through text-only channels, not to hide them. If you see Base64 in a config file or a URL and assume it is “obfuscated,” you are wrong — treat it as plain text.

If you need confidentiality, use actual encryption (AES-GCM, ChaCha20-Poly1305, libsodium), then optionally Base64 the ciphertext for transport.

How to use this tool

Text mode: type or paste in the input area and choose Encode or Decode. The output updates as you type.
File mode: drop a file to receive its Base64 string, or paste a Base64 string to reconstruct and download the original file.
URL-safe toggle: switch alphabets if you are working with JWTs, Webcrypto, or URL parameters.

Frequently asked questions

Why does my Base64 string end with `=` or `==`?

Padding. = means one byte of input was missing from the final group of three; == means two bytes were missing. The padding keeps the output length a multiple of four, which matters for streaming decoders.

Is Base64 case-sensitive?

Yes. Y2F0 decodes to cat; y2f0 does not. Standard Base64 uses both cases as distinct symbols.

Does Base64 produce the same output for the same input?

Yes, it is deterministic and unambiguous. Two encoders that follow the spec will always produce identical output (modulo the choice of standard vs URL-safe alphabet).

Can I Base64 a very large file in the browser?

This tool loads the file into memory before encoding, so files up to a few hundred megabytes work on a typical laptop. For larger inputs, a streaming command-line tool (base64, openssl base64, or language-level APIs) is more appropriate.

What about Base32 and Base58?

Base32 uses 32 symbols and is case-insensitive — useful when the output will be spoken aloud or transcribed. Base58 (used in Bitcoin addresses) drops visually confusable characters (0, O, I, l). Both are less space-efficient than Base64 but solve different legibility problems.

Privacy note

Encoding and decoding happen entirely inside your browser tab. Neither text nor files are uploaded to any server.

Base64 Encoder / Decoder