Convert text to Base64 and back, instantly and privately in your browser.
Your result will appear here.
Why
Base64 encodes binary or text data into a safe set of ASCII characters, which is why it shows up everywhere in development — data URIs, email attachments, API tokens, and config files. Sometimes you need to encode a value; other times you need to read what an encoded blob says. The reason Base64 exists is that many systems were designed to handle plain text reliably but choke on raw binary or on characters outside a narrow range. Email, for example, was historically a text-only medium, so a photo or PDF attachment has to be translated into letters, digits, and a couple of symbols before it can travel through a mail server intact. Base64 is that translation: it takes any sequence of bytes and re-expresses it using only sixty-four printable characters, guaranteeing the data survives transport through channels that would otherwise mangle it. Having a quick encoder and decoder on hand turns this routine but fiddly task into a single paste.
This tool encodes text to Base64 and decodes Base64 back to text, with full Unicode support, entirely in your browser so sensitive values never leave your device. That local-only design matters because the strings you work with are often confidential — API keys, session tokens, signed payloads, or snippets of configuration that should never be pasted into a random website that quietly logs everything it receives. Because all of the encoding and decoding here is done with JavaScript on your own machine, there is no upload, no server-side processing, and no copy of your data sitting in someone else's logs. You can disconnect from the internet after the page loads and the tool keeps working, which is the clearest possible proof that your input is staying put. For anyone who handles secrets as part of their job, that privacy is not a nice-to-have but a requirement.
Understanding what Base64 actually does helps you use it correctly. The algorithm reads your data three bytes at a time, which is twenty-four bits, and splits those bits into four groups of six. Each six-bit group maps to one character in the Base64 alphabet, which is the uppercase letters, the lowercase letters, the digits zero through nine, and the two symbols plus and slash. When the input length is not a clean multiple of three, the output is padded with one or two equals signs so the result is always a multiple of four characters. This is why Base64 strings are roughly a third larger than the original data and why they so often end in one or two equals signs. Knowing this structure makes encoded values far less mysterious: you can recognize Base64 on sight and understand why a tiny image becomes a long inline string.
A point that constantly trips people up is that Base64 is encoding, not encryption, and treating it as a security measure is a serious mistake. Encoding simply changes the representation of data so it can move safely through a text channel, but the transformation is completely public and reversible by anyone — there is no key and no secret involved. Decoding a Base64 string requires nothing more than the same algorithm everyone has access to, including this tool. So while it is perfectly fine to store a token in Base64 form for transport, you should never assume that Base64 hides or protects sensitive information. If a value needs to be kept secret, it must be encrypted with a real algorithm and a key, and only then perhaps encoded for transport. Confusing the two has led to real breaches where developers believed Base64 was obscuring credentials that were, in fact, trivially readable.
Data URIs are one of the most common everyday uses of Base64, and a good encoder makes them painless to build. A data URI embeds a small file — typically an image, font, or short asset — directly inside HTML or CSS as a Base64 string, so the browser does not have to make a separate network request to fetch it. For tiny icons or background images, inlining them this way can shave off round trips and speed up the first render, which is why build tools often inline small assets automatically. To craft one by hand you encode the file's bytes to Base64 and wrap it with the appropriate media-type prefix. Being able to encode quickly and copy the result lets you prototype these inline assets, test a snippet, or decode an existing data URI to inspect what was embedded. It is worth remembering that the encoded form is about a third larger than the original file, so inlining is a win for very small assets but a poor trade for large ones, which are better served by a normal cached request.
Base64 also surfaces constantly when you are debugging and inspecting systems, which is where a decoder earns its keep. JSON Web Tokens are made of Base64URL-encoded segments, basic authentication headers carry Base64-encoded credentials, many APIs return binary results as Base64 fields, and configuration formats frequently store certificates or keys in Base64 blocks. When something goes wrong, being able to paste one of these strings and instantly see the human-readable content underneath turns an opaque error into an obvious one. You can confirm whether a token contains the claims you expect, check that a credential header was assembled correctly, or verify that a config value decodes to the certificate you intended. Without a quick decoder this kind of investigation means writing throwaway scripts; with one, it is a single paste and a glance.
It also pays to understand the variants of Base64 so you do not get tripped up by the wrong flavor. The standard alphabet uses plus and slash for its last two characters, but those are problematic in URLs and filenames, so a separate Base64URL variant swaps them for hyphen and underscore and often drops the trailing padding. This is the form you see in JWTs and in many web tokens, and feeding a Base64URL string into a strict standard decoder, or the reverse, is a common reason decoding appears to fail. There are also subtler issues like line wrapping, where some systems insert newlines every sixty-four characters in long encoded blocks, and whitespace that sneaks in when you copy a value from a terminal or an email. A good mental model of these edge cases means that when a decode does not work, you can usually spot the cause — wrong variant, stray whitespace, missing padding — and fix it in seconds rather than assuming the data itself is corrupt.
How
Pick Encode to turn readable text into a Base64 string, or Decode to turn a Base64 string back into readable text. Selecting the right mode is the only setting you need, since the tool handles UTF-8 and padding automatically.
Add the text you want to encode or the Base64 string you want to decode into the input box. Everything you paste stays in your browser, so it is safe to drop in tokens, config values, or other sensitive strings.
The converted result appears instantly and is ready to copy into your code, config, terminal, or wherever you need it. If decoding fails, check the input for stray characters or whitespace and try again.
Who
Developers encode and decode tokens, data URIs, and API payloads constantly while building and integrating systems. A quick local tool saves writing throwaway scripts every time a value needs to be wrapped for transport or read back during debugging, which adds up across a workday spent moving data between services that each have their own encoding expectations.
Testers inspect encoded values in requests and responses to verify that systems are passing the right data. Decoding a Base64 field on the spot confirms whether a payload, credential header, or token contains exactly what the test expects.
Operations staff read and write Base64 values in configuration files, Kubernetes secrets, and certificates, where binary data is routinely stored as text. Being able to decode a secret to verify its contents, or encode a new value to insert, is a daily task.
People learning how data moves through systems use a Base64 tool to see encoding and decoding in action. Watching text turn into the sixty-four-character alphabet and back makes an abstract concept concrete and builds intuition for how transport encoding works.
Analysts frequently decode Base64 strings found in tokens, headers, payloads, and obfuscated samples to reveal what they actually contain. A fast, private decoder lets them inspect suspicious values without exposing them to a third-party service.
People who connect software to third-party APIs often need to assemble or read Base64-encoded authentication headers and webhook payloads. Encoding credentials correctly and decoding incoming data quickly keeps integrations moving without guesswork, and being able to verify a value on the spot turns a vague vendor error into a concrete, fixable detail.
When
When a response or request contains a Base64-encoded field and you need to see what is inside it. Decoding the value on the spot turns an opaque blob into readable content so you can confirm the data is correct.
When embedding a small image, font, or asset directly into HTML or CSS to avoid an extra network request. Encoding the file to Base64 and wrapping it with the right media-type prefix produces an inline asset the browser can render without fetching it.
When you need to decode an encoded value such as a JWT segment or an authentication header to verify its contents. A quick decode confirms whether the claims, credentials, or payload match what you expect, which is often the fastest way to tell whether an authentication problem lies in the token itself or somewhere else entirely.
When secrets, certificates, or keys are stored Base64-encoded in configuration, you may need to decode one to inspect it or encode a new value to insert. This is routine when managing environment files and orchestration secrets.
When data has to travel through a medium that only handles text reliably, such as email or certain message formats, encoding it to Base64 keeps the bytes intact in transit. Decoding on the other end restores the original content exactly.
When you encounter an unfamiliar Base64-looking string in logs, headers, or a sample, decoding it reveals whether it hides readable text or data. A private, local decoder lets you do this without sending the value to an external service, which matters when the string might contain sensitive or malicious content you would not want to hand to a random website.
Convert text to Base64 and back, instantly and privately in your browser.
Use the Base64 Encoder / Decoder