Base64 Encoder / Decoder
Encode text to Base64 or decode Base64 back to readable text. Full UTF-8 support (including Chinese, emoji and accents) and URL-safe Base64 input are handled
Convert text to Base64 and back. Base64 turns arbitrary bytes into plain ASCII characters, which is why it appears in data URIs, email attachments, API tokens and configuration files where binary data would otherwise break the transport.
Decoding is the more common need: a JWT payload, a Basic auth header, an API key or an embedded image all arrive as Base64 and need to be read. Encoding is the reverse, and both directions support UTF-8, so accented characters and emoji survive the round trip.
How to encode and decode Base64
Paste text or Base64
Choose encode or decode
Copy the result
FAQ
Does it support UTF-8 text?
Yes. Accented characters, CJK text and emoji are handled correctly in both directions; a naive encoder would corrupt them.
Why does my decoded text look broken?
That usually means the input was not valid Base64 or it was a binary file rather than text. Check for missing padding characters (=) or line breaks inside the value.
Can I use it for images?
There is a separate tool that turns an image file into a Base64 data URI, which is what you need for embedding a picture in CSS or HTML.
Is Base64 a form of encryption?
No, it is only an encoding - anyone can reverse it. Never treat Base64 as protection for a secret.
Is there a size limit?
The limit is your device memory. Text of several megabytes is handled instantly.
Is my data uploaded?
No, encoding and decoding happen in your browser, which matters for tokens and credentials.
At a glance
| Input | text |
|---|---|
| Multiple files | No |
| Where it runs | In your browser - files are never uploaded |
| Works offline | Yes — once the page has loaded |
| Price | Free, no sign-up, no watermark |
Handling secrets safely
Developer tools process credentials more often than people realise, and the risk is not the algorithm but where the data goes. Hashing is one-way and is not encryption - MD5 and SHA-1 are broken for anything security-related, and even SHA-256 is the wrong tool for storing passwords, where bcrypt, scrypt or Argon2 exist precisely to be slow. Base64 is an encoding, not protection: anyone can decode it, so never treat it as obfuscation. A JWT can be read by anyone who holds it, which is why the payload must never contain secrets, and decoding a token does not verify its signature - verification requires the key. Everything on this site runs locally in your browser, which is the reason it can safely handle tokens and passwords at all.
Where conversions quietly break
Most conversion bugs are not about syntax, they are about meaning. A CSV column of postcodes loses its leading zeros the moment a spreadsheet guesses it is a number; a long ID exceeds floating-point precision; dates change meaning depending on whether they are day-first or month-first. JSON keys are unordered but arrays are not, and a tool that sorts keys changes nothing while one that sorts arrays changes the data. Unicode is another trap: text can arrive as UTF-8, UTF-16 or with a byte-order mark, and a decoder that guesses wrong turns accented characters into mojibake. Before trusting any conversion, spot-check the first and last row, any field with leading zeros, and any field containing quotes, commas or newlines.