Is Base64 encryption?

No, and this matters. Base64 is an encoding, not a cipher. There is no key and anyone can reverse it instantly, exactly as this page does. Never use it to protect a password, a token, or anything else sensitive. It is only for making bytes survive a text-only channel.

Does my data get uploaded?

No. Encoding and decoding both happen in your browser. Nothing is transmitted, so it is safe to decode a value from a config file or a secret without it reaching a server. That said, treat any decoded credential as you would the original.

When should I use URL-safe Base64?

Use it whenever the result goes into a URL path, a query parameter, a cookie, or a filename. Standard Base64's plus and slash characters have meaning in those contexts and will be re-encoded or rejected. If you are decoding a JWT or an OAuth token, it is almost certainly URL-safe already.

Why is the encoded output longer than my input?

Base64 turns every three bytes into four characters, so the result is about 33 percent larger, plus padding. That overhead is the price of using only safe printable characters, and it is why you would not Base64-encode a large file for transport if you had any alternative.

Encoding & conversion

Base64 Encoder & Decoder

Convert text to and from Base64, with URL-safe support.

Direction

URL-safe alphabet

Uses - and _ instead of + and /, and drops padding.

Text input

0 bytes

Text to encode

Base64 output

About this tool

Base64 represents arbitrary bytes using only 64 printable ASCII characters. It exists because plenty of systems were designed to carry text and will corrupt raw binary: email bodies, JSON string fields, HTTP headers, data URIs, YAML values, environment variables.

You will most often meet it when reading an HTTP Basic auth header, inspecting the payload segment of a token, embedding a small image directly in CSS as a data URI, or pulling a certificate or key out of a Kubernetes secret. In each case what you have is a run of letters and digits that you need to turn back into something readable.

This tool handles the full Unicode range in both directions. That matters more than it sounds: the browser's own btoa function throws on any character above U+00FF, so naive implementations break the moment your text contains an emoji, a curly quote, or any non-Latin script. Text here is converted to UTF-8 bytes before encoding and decoded back from UTF-8 afterwards, so round-tripping is lossless.

There is also a URL-safe mode, which swaps the two characters that cause trouble in a URL or filename. Standard Base64 uses plus and slash, which get mangled by URL encoding; the URL-safe alphabet uses minus and underscore instead and usually drops the trailing padding. JWTs and many API tokens use this variant, so if a normal decode gives you nothing, try it.

How to use it

Choose Encode or Decode.
Paste your text or Base64 string into the input panel.
Switch on URL-safe if your string uses minus and underscore instead of plus and slash.
Copy the result from the output panel.

Frequently asked questions

Is Base64 encryption?: No, and this matters. Base64 is an encoding, not a cipher. There is no key and anyone can reverse it instantly, exactly as this page does. Never use it to protect a password, a token, or anything else sensitive. It is only for making bytes survive a text-only channel.
Does my data get uploaded?: No. Encoding and decoding both happen in your browser. Nothing is transmitted, so it is safe to decode a value from a config file or a secret without it reaching a server. That said, treat any decoded credential as you would the original.
When should I use URL-safe Base64?: Use it whenever the result goes into a URL path, a query parameter, a cookie, or a filename. Standard Base64's plus and slash characters have meaning in those contexts and will be re-encoded or rejected. If you are decoding a JWT or an OAuth token, it is almost certainly URL-safe already.
Why is the encoded output longer than my input?: Base64 turns every three bytes into four characters, so the result is about 33 percent larger, plus padding. That overhead is the price of using only safe printable characters, and it is why you would not Base64-encode a large file for transport if you had any alternative.