Base64 Encoder / Decoder

What is Base64?

Base64 is a way to represent binary data using only 64 printable ASCII characters (A-Z, a-z, 0-9, +, /). It exists because many systems, email headers, URLs, JSON, HTTP basic auth, were built for text and will mangle raw bytes. Encoding to Base64 lets binary travel safely through a text-only channel, then decode back to the exact original bytes on the other side.

Why Base64 exists

The same need shows up all over the stack, any time bytes have to ride through something built for text:

• Email (MIME): attachments are Base64 so 8-bit binary survives mail servers that expect text. See how SMTP works.
• Data URIs: a small image or font embedded straight into HTML or CSS as data:image/png;base64,…, no extra request.
• JSON & APIs: JSON has no binary type, so bytes (a file, a hash, an image) travel as a Base64 string. Pair it with JSON tools.
• HTTP Basic auth: the Authorization header sends Base64(user:pass). See HTTP explained.
• Tokens: a JWT is three Base64URL parts; its payload is just Base64-encoded JSON.

How Base64 works

Base64 takes 3 bytes (24 bits) at a time and splits them into 4 groups of 6 bits. Each 6-bit group is a number from 0 to 63, which maps to one character in the alphabet below. Three input bytes always become four output characters, which is why Base64 is about 33% larger than the original.

Encode the whole word Hello (5 bytes) and you get SGVsbG8=. The trailing = is padding: when the input is not a clean multiple of 3 bytes, one or two = keep the output length a multiple of 4. Try it in the tool above.

Standard vs URL-safe

• Standard uses + and / and pads with =.
• URL-safe (RFC 4648 §5) swaps + to - and / to _, and usually drops the =, so the string is safe inside a URL or filename. Toggle it above.

Base64 character table

The 64 values and the character each one maps to (index 0 to 63):

Common examples

• Encode text: Hello becomes SGVsbG8=.
• Decode: S0IgQ2FmZQ== becomes KB Cafe (load the sample above).
• Data URI: data:text/plain;base64,SGVsbG8= renders as Hello.
• JWT payload: the middle segment of a token is Base64URL JSON, decode it with the JWT decoder.

Base64 in code

JavaScript

// Browser, Unicode-safe (handles emoji and accents)
const bytes = new TextEncoder().encode("Hello");
const b64   = btoa(String.fromCharCode(...bytes));   // "SGVsbG8="

const bin  = atob(b64);
const text = new TextDecoder().decode(Uint8Array.from(bin, c => c.charCodeAt(0)));

// Node.js
Buffer.from("Hello", "utf8").toString("base64");      // "SGVsbG8="
Buffer.from("SGVsbG8=", "base64").toString("utf8");   // "Hello"

Python

import base64

base64.b64encode(b"Hello").decode()      # 'SGVsbG8='
base64.b64decode("SGVsbG8=").decode()    # 'Hello'

# URL-safe variant
base64.urlsafe_b64encode(b"Hello").decode()
base64.urlsafe_b64decode(data)

Base64 vs Hex

Both turn bytes into text. They trade size against readability:

Common mistakes

• Treating it as security. Base64 is trivially reversible, this page decodes it in one click. It hides nothing; use real encryption for secrets.
• Unicode with btoa(). Raw btoa("café") throws. Encode to UTF-8 bytes first (as the JavaScript example does).
• Dropped or wrong padding. Some decoders reject a string whose length is not a multiple of 4. If you stripped =, add it back before decoding.
• Forgetting URL-safe. Standard Base64’s + and / break inside URLs and filenames. Use the URL-safe variant there.
• Double encoding. Encoding an already-Base64 string just makes it bigger and confusing.

FAQ

Related concepts

JWT decoder · JSON to TypeScript · HTTP explained · How SMTP works · What is RSS · all references.