Base64 Encoder

What is Base64 encoding

Base64 is a way of writing arbitrary bytes using only 64 characters that survive being treated as text: A–Z, a–z, 0–9, plus and slash, with the equals sign as padding. It exists because a great many channels were designed for text and mangle anything else: an email header, a URL query string, a JSON field, an XML attribute, a cookie, a YAML value in a Kubernetes secret. Encode the bytes first and they arrive intact.

The cost is size. Three bytes become four characters, so a Base64 string is about 33% larger than the data it carries, plus padding. That is the trade: you pay a third more bandwidth to pass through a text-only pipe without corruption.

How to encode text to Base64 here

• Type, paste, or open a file the encoder works on whatever is in the input pane, and Open file reads a text file from disk. Everything stays on your machine.
• Choose URL-safe if the result goes in a URL standard Base64 uses + and /, which mean something else inside a query string or a path. URL-safe Base64 (RFC 4648 §5, also called base64url) substitutes - and _ and drops the padding, which is what JWTs, OAuth state parameters and data URLs in query strings use.
• Copy or download Copy takes the string; Download saves it as a .txt file. Send back swaps the panes, so you can immediately decode what you just encoded and confirm the round trip.

Accents, emoji and the UTF-8 step

Base64 encodes bytes, not characters, so before anything can be encoded the text has to be turned into bytes, and which bytes depends on the character encoding. This tool encodes your text as UTF-8 first, which is the modern default everywhere and the only sane choice for anything that will travel.

Skipping that step is the classic bug. A naive implementation that uses one byte per character works until the first accented letter, then produces a string that decodes to mojibake or fails outright. If you have ever seen "perché" come back as "perché", you have seen the two ends of a pipe disagreeing about encoding. Text encoded here round-trips correctly through accents, Greek, Cyrillic, CJK and emoji.

Base64 is not encryption

This is worth stating plainly because the mistake is common and expensive. Base64 is an encoding: it is fully reversible by anyone, with no key, in a fraction of a second, including by this page. A Base64 string in a request looks opaque to a human skimming a log, and that is exactly what makes it dangerous, because it is not opaque to anyone who thinks to paste it into a decoder.

So never use Base64 to hide a password, an API key or personal data. A Kubernetes secret is stored Base64-encoded for transport reasons, not for protection; HTTP Basic authentication sends the credentials Base64-encoded, which is why it is only acceptable over HTTPS. If you need the content to be unreadable, you need encryption, and probably a key manager.

Where you will meet it

• Data URLs data:image/png;base64,… embeds a small image or font directly in HTML or CSS, saving a request at the cost of a third more bytes and no caching of its own.
• JWTs the header and payload of a JSON Web Token are base64url-encoded JSON, separated by dots. Decoding one shows the claims, which is a reminder that a JWT payload is readable by its bearer.
• Email attachments MIME has carried binary attachments as Base64 since 1992, which is why a 3 MB photo makes a 4 MB email.
• Basic auth and API tokens the Authorization header carries base64(user:password), and a number of APIs expect a Base64-encoded key.