Base64 Encoder and Decoder

Base64 turns 3 bytes into 4 characters

Base64 encoding takes data 3 bytes (24 bits) at a time, splits those bits into four groups of 6, and writes each number from 0 to 63 as one of 64 characters: A-Z, a-z, 0-9, + and /. Three bytes therefore always become four characters, and the result is about 33% longer than the original. Text is first turned into bytes, so 'Hello, café 👋' is 17 bytes (é takes two bytes in UTF-8 and the emoji takes four) and becomes the 24-character SGVsbG8sIGNhZsOpIPCfkYs=, with one = at the end. Base64 is not encryption, so anyone can reverse it.

The tool above lets you edit either box. Edit the text and it encodes; paste a value into the Base64 box and it decodes. Wrapped values such as an Authorization: Basic header, an email subject like =?UTF-8?B?…?=, a data: URL, a PEM certificate or a PowerShell -EncodedCommand are unwrapped for you. Bytes that are not valid UTF-8 are tried as Windows-1252 or UTF-16, or shown as a file such as a PNG or PDF. The decoding route shows the steps the conversion took, and the group rail and magnifier show where 3 bytes turn into 4 characters.

When you need to decode or build Base64 by hand

• Checking an HTTP Basic auth header: RFC 7617 joins the user name, a colon (:) and the password, encodes the result as Base64 and sends it after Authorization: Basic. For example, admin:1234 becomes YWRtaW46MTIzNA==. That also means anyone who sees the header can read the password, so Basic auth belongs on HTTPS only.
• An email subject that looks like =?UTF-8?B?…?=: Mail headers are limited to ASCII, so a subject with an emoji or accents is written as an RFC 2047 encoded-word. The text between the first question marks (UTF-8 here) is the character encoding, and B means Base64. Paste the whole header value and the tool decodes it with the encoding it names; a value such as =?UTF-8?B?WW91ciBvcmRlciBoYXMgc2hpcHBlZCDwn5Om?= reads as 'Your order has shipped 📦'.
• Reading config values or a Kubernetes Secret: Values in the data field of a Kubernetes Secret must be Base64 strings; use stringData if you would rather not encode them. Use the tool to see what a stored value is, or to make the Base64 for a new one.
• Putting an image or PDF inside JSON: Base64 is a common way to carry file bytes in a format that only accepts text. If the value in the Base64 box is not text, the tool shows its type and size and lets you save it as a file.
• Looking inside a JWT: Each dot-separated part of a JWT is Base64url (RFC 7515): URL-safe characters with the trailing = removed. The header and payload decode here too, but the signature is not verified.
• Building or checking a PowerShell -EncodedCommand value: The PowerShell documentation says the value must be the Base64 of a UTF-16LE string. The same Get-Date is R2V0LURhdGU= in UTF-8 but RwBlAHQALQBEAGEAdABlAA== in UTF-16LE.
• Working with certificate and key files (PEM): The body between -----BEGIN CERTIFICATE----- lines is Base64, wrapped at 64 characters per line as RFC 7468 requires. Decoding it gives DER bytes.

How to use it

1. Encode: Type or paste text in the text box, or choose a file with 'Add file'. You can also drop or paste a file into the text box. The Base64 appears right away in the Base64 box.
2. Decode: Paste a value into the Base64 box. Quotes or a header name around it are fine. The text appears in the text box, or, if the bytes are not text, a file card shows the type and size.
3. Choose the shape: In the settings bar pick standard (+ /) or URL-safe (- _), padding with or without =, and one line, 76 or 64 characters per line. The shape of a pasted value is copied into the settings, so if you edit the decoded text it is rebuilt in the same shape.
4. Text encoding: The default is auto-detect. If the decoded text looks wrong, choose UTF-8, UTF-16LE, Windows-1252 or another encoding yourself. If the box holds one value per line, turn on 'Each line separately'.
5. Check: The decoding route shows the wrapper that was removed, the whitespace that was ignored and the padding that was added. Click a group on the rail to see its bits in the magnifier. If another tool gives a different result, look in 'Same text, different Base64' and click a row to copy that value.

The rule behind 3 bytes becoming 4 characters

Take the three ASCII bytes of 'Man', 4D 61 6E. Joined, they make 24 bits; cut into 6-bit pieces they give four numbers between 0 and 63; look those up in the alphabet below and you get TWFu.

When the data does not divide evenly into 3-byte groups, the missing bits are filled with 0 to finish the last character, and the empty slots are written as =. One leftover byte gives 2 characters and ==; two leftover bytes give 3 characters and =. RFC 4648 says an encoder sets the filler bits to 0 and a decoder may reject any other value.

How long is the Base64?

With padding the length is 4 × ⌈n ÷ 3⌉ (n = number of bytes); without padding it is ⌈4n ÷ 3⌉. What counts is the number of bytes, not characters. In UTF-8 a plain English letter is 1 byte, an accented letter such as é is 2 and an emoji is 4, so text with many accents or symbols grows more than plain ASCII. Wrapping every 76 characters with a CRLF line break, as email does, adds 2 characters per line.

Standard, URL-safe, MIME and PEM compared

The names differ, but the 3-bytes-to-4-characters calculation is the same. Only three things change: characters 62 and 63, the trailing =, and line wrapping.

Decoders also differ in how strict they are. RFC 4648 says to reject characters outside the alphabet, while RFC 2045 for email says to ignore line breaks and characters that are not in the table. The browser's atob() removes only whitespace and throws an error on - or _ (WHATWG forgiving-base64). This tool ignores line breaks and spaces, turns %2B, %2F and %3D from URLs and \n escapes from JSON back into their characters, and accepts both standard and URL-safe characters. Anything else stops it, and it tells you the position.

The same text gives different Base64 in each text encoding

Base64 only writes bytes as characters, so the result depends on which bytes the text was turned into, that is, on the text encoding. Plain ASCII such as Hello has the same bytes in UTF-8 and Windows-1252, so the Base64 is the same too. Accented letters differ between the two, and UTF-16 doubles every character, so no result matches.

Auto-detect first checks the opening bytes for a file signature such as PNG or JPEG. It then tries, in order, (1) an encoding that is written down or fixed, as in an email subject, a data: URL or PowerShell; (2) a BOM at the start (EF BB BF, FF FE, FE FF); (3) the UTF-16 pattern of a 00 byte after every ASCII character; (4) UTF-8, and keeps the first reading without control characters. If none of these works, it reads the bytes as EUC-KR, Shift_JIS, Windows-1252 and UTF-16 without 00 bytes, and picks the reading best filled with that encoding's own letters (Hangul, kana and kanji, accented Latin letters). On a tie, the page language's encoding wins (Windows-1252 on this page). Bytes alone cannot prove the encoding, so if the result looks odd, choose it yourself in the settings bar.

Wrappers the tool removes from pasted values

A copied value often has a header name or format marker around the Base64. The shapes below are unwrapped and only the Base64 inside is read; when you edit the text, the same wrapper is put back (except for a JWT, which needs its signature). Press the x button on the 'Wrapper kept' chip in the decoding route to drop the wrapper.

When it will not decode: causes by error

If the value in the Base64 box cannot be read, the status line says which character it stopped at and shows the characters around it. The text box stays dimmed and shows the last result that was read successfully.

When the result differs from another tool

If you enter the same text and the Base64 differs, the bytes are almost always different or the shape settings are. The 'Same text, different Base64' list under the tool recalculates the cases below for your current text and shows the first difference.

Doing it in code

The browser's btoa() throws InvalidCharacterError for any character that does not fit in one byte, so text with an emoji or most non-Latin letters must be turned into UTF-8 bytes first. The newer Uint8Array.prototype.toBase64() works in Chrome 140, Firefox 133 and Safari 18.2 and later.

// JavaScript: turn text into UTF-8 bytes first (fine for short text)
const bytes = new TextEncoder().encode('café');
const b64 = btoa(String.fromCharCode(...bytes));          // Y2Fmw6k=
const back = new TextDecoder().decode(Uint8Array.from(atob(b64), c => c.charCodeAt(0)));
bytes.toBase64({ alphabet: 'base64url', omitPadding: true }); // newer API

# Python
import base64
base64.b64encode('café'.encode('utf-8'))   # b'Y2Fmw6k='
base64.b64decode('SGVsbG8')                # no = at the end: binascii.Error: Incorrect padding
base64.b64decode('Zm9v-_', validate=True)  # error instead of silently dropping non-alphabet characters

# Command line
printf '%s' 'café' | base64    # echo adds a trailing newline
base64 -w 0 report.pdf         # GNU: no wrapping (macOS base64 is one line by default; -b 76 wraps)

Common mistakes

• Treating Base64 as encryption: Anyone can reverse it without a key. Turning a password or token into Base64 does not hide it.
• Using a value made with echo as it is: echo adds a trailing newline, so the result ends differently, for example in K or o=. Use printf '%s' or echo -n.
• Changing letter case: Base64 treats upper and lower case as different characters. Changing the case to tidy it up gives different data or a value that no longer decodes.
• Putting standard Base64 straight into a URL query: In form-data parsing + becomes a space, and / and = also have meaning inside a URL. Use URL-safe Base64 or percent-encode the value.
• Encoding twice: If the decoded result still looks like Base64, a 'Decode once more' button appears next to the status line.
• Leaving off the data: prefix on an image: In HTML or CSS you need the data:image/png;base64, prefix. For images, the image to Base64 converter builds the HTML and CSS forms for you.

Limits

• Files up to 5 MB can be added (about 7 million characters of Base64). If the text in a box passes 400,000 characters, only the start and end are shown; copy and save still include all of it.
• Auto-detect is an estimate from the shape of the bytes. A short value can be read in several encodings, so it can be wrong.
• You can build UTF-8, UTF-16LE and BE, EUC-KR (CP949), Shift_JIS and Windows-1252. An encoding named in an email subject that the tool cannot build, such as ISO-2022-JP, is read only; if you edit the decoded text, it is rebuilt in UTF-8.
• The JWT signature is not verified, and Q encoding in an email subject (=?…?Q?…?=) is not decoded.
• A browser text box turns line breaks into LF, so line breaks in the text box are encoded as LF. If you need CRLF, copy the CRLF row from 'Same text, different Base64'.
• The group rail draws the first 480 groups (1,440 bytes). The rest is still converted and copied.
• Everything is converted inside this browser; the value you enter is not sent to a server or kept in the address or in storage.

Sources

Basis: The Base64 format follows RFC 4648, the uses in email, PEM, authentication headers and JWT follow their own RFCs, browser behaviour follows the WHATWG standards and MDN, and command-line and language behaviour follows each manual; all were checked on 21 October 2026. The values in the tables were confirmed with this tool and Python 3.14's base64 module.

• 01RFC 4648 — The Base16, Base32, and Base64 Data Encodings3.1 line breaks, 3.3 rejecting characters outside the alphabet, 3.5 spare bits set to 0, section 4 alphabet, section 5 URL-safe (- _), section 10 test values
• 02RFC 2045 — MIME Part One6.8 lines of at most 76 characters; decoders ignore line breaks and characters not in the table
• 03RFC 2047 — MIME Part Three: Message Header Extensionsencoded-word form =?charset?B?…?=, at most 75 characters per word, B = BASE64
• 04RFC 7468 — Textual Encodings of PKIX StructuresPEM body wrapped at 64 characters per line except the last
• 05RFC 7617 — The 'Basic' HTTP Authentication Schemeuser name + ':' + password as Base64; the charset parameter allows UTF-8 only
• 06RFC 7515 — JSON Web Signature (JWS)Section 2 Base64url: URL-safe characters, trailing = removed, no line breaks
• 07RFC 2397 — The "data" URL schemedata: + media type + optional ;base64 + comma + data
• 08WHATWG Infra — forgiving-base64 decodeRules behind atob(): strip whitespace, allow 1 or 2 trailing =, fail on characters outside + /
• 09WHATWG — Encoding StandardHow TextDecoder reads UTF-8, UTF-16, EUC-KR, Shift_JIS and Windows-1252
• 10MDN — Window.btoa()InvalidCharacterError for characters that do not fit in one byte
• 11MDN — Uint8Array.prototype.toBase64()alphabet (base64, base64url) and omitPadding options; supported versions come from the MDN browser compatibility data
• 12Python 3 — base64 moduleb64decode(validate=False) discards characters outside the alphabet; urlsafe_b64encode
• 13GNU coreutils — base64(1)-w (--wrap) defaults to 76; 0 means no wrapping
• 14Microsoft Learn — about_PwshThe -EncodedCommand value is the Base64 of a UTF-16LE string
• 15Kubernetes — SecretsValues in the data field are Base64; use stringData to avoid encoding

Frequently asked questions

Tools to use with this one