Base64 encode and decode online (UTF-8, URL-safe)

Base64 (RFC 4648) represents any binary data with 64 safe characters: A-Z, a-z, 0-9, + and /. Every 3 bytes (24 bits) are split into 4 groups of 6 bits, and each group maps to one character. When the input length is not a multiple of three, the output is padded with = or ==.

Example: “Man” is the bytes 77, 97, 110 = 01001101 01100001 01101110 → groups 19, 22, 5, 46 → TWFu. That is why Base64 output is always about 33% larger than the original: 4 characters for every 3 bytes. The exact length is 4 × ⌈n ÷ 3⌉ characters for n bytes, so 100 bytes become 136 characters.

The browser function btoa() only accepts Latin-1 characters, so btoa("€") or btoa("😀") throws an error. This tool first converts text to UTF-8 bytes with TextEncoder and only then encodes those bytes, which is what every server-side language does. Accented letters take 2 bytes in UTF-8 and emoji take 4: “café” (4 letters, 5 bytes) becomes Y2Fmw6k=.

When decoding, the tool checks that the bytes form valid UTF-8. If they do not, you most likely pasted an encoded binary file such as an image or a PDF, and the tool tells you so instead of showing garbage.

Base64 is not encryption. Anyone can decode it without a key, so never use it to hide passwords. To check integrity, use a hash such as SHA-256 from the hash generator; to protect data, use real encryption.

• Data URIs - data:image/png;base64,iVBORw0… embeds a file directly in HTML or CSS; convert a picture with Image to Base64.
• HTTP Basic Auth - Authorization: Basic dXNlcjpwYXNz is simply user:pass encoded.
• JSON Web Tokens - three Base64URL parts separated by dots; read them comfortably in the JWT decoder.
• Email attachments (MIME) - Base64 with lines wrapped at 76 characters.

The most common decoding problems are a truncated string (length not divisible by 4 even after padding), spaces or line breaks copied from a document, mixing up Base64 and Base64URL, and trying to read a binary file as text. This decoder normalises whitespace, padding and both alphabets automatically, so only genuinely broken input produces an error. For query strings and form data you want percent-encoding instead - see the URL encoder.