🔐 Base64
Base64 Encoder & Decoder
Turn text into Base64 or turn Base64 back into text. Accented characters, emoji and every other non-ASCII character are handled as UTF-8. Press Convert.
About the Base64 converter
Base64 rewrites binary data using only 64 characters that survive email, URLs and JSON. Every three bytes become four characters, so the output is about 33% longer than the input. Three bytes make 24 bits, and 24 bits divide neatly into four groups of six, which is why the alphabet has 64 symbols and why the length is always a multiple of four once padding is added.
Encoding is not encryption. Anyone can decode it in a second, so never treat Base64 as a way to protect a password, a key or personal data. It hides the shape of data, not its content.
The two alphabets
| Feature | Standard | URL-safe |
|---|---|---|
| Characters 62 and 63 | + and / | - and _ |
| Padding | = to a multiple of four | usually omitted |
| Safe in a query string | needs escaping | yes |
| Common uses | MIME, data URIs, PEM keys | JWTs, file names, URLs |
How it works, byte by byte
- Take three bytes — 24 bits.
- Split them into four groups of six bits.
- Look up each group in the alphabet
A–Z a–z 0–9 + /. - If fewer than three bytes remain, pad with
=so the length stays a multiple of four.
Worked examples
| Text | Base64 |
|---|---|
Man | TWFu |
Ma | TWE= |
M | TQ== |
Hello | SGVsbG8= |
café | Y2Fmw6k= |
URL-safe Base64, padding and line breaks
The standard alphabet uses + and / for the last two of its 64 symbols. Both characters have reserved meanings in URLs and filenames, so a second variant called Base64url replaces them with - and _. JSON Web Tokens, most OAuth flows and many APIs use Base64url rather than the standard alphabet, which is why a token copied out of a header sometimes contains hyphens where you expected plus signs.
Padding is the second difference. Standard Base64 encodes three bytes into four characters, so input that is not a multiple of three leaves the final group short and the encoder fills it with = characters — one for a two-byte remainder, two for a one-byte remainder. Base64url usually drops the padding altogether, because the decoder can infer it from the length. If a decoder rejects a string that looks correct, check the padding first.
Line breaks are the third. The MIME variant used in email breaks output every 76 characters with CRLF; the raw variant produces one unbroken line. A string containing newlines will fail in any decoder that expects raw Base64, and a long raw string may be wrapped by an email client in ways you did not intend.
| Symbol value | Standard | URL-safe |
|---|---|---|
| 62 | + | - |
| 63 | / | _ |
| Padding | = or == | usually omitted |
One thing worth stating plainly: Base64 is an encoding, not encryption and not compression. It makes data between 33 and 37 percent larger, and anyone can decode it. It exists so that binary data can travel through channels that only accept text.
Frequently asked questions
= means the input was two bytes short, two means it was one byte short. The URL-safe variant usually drops them.Common mistakes to avoid
- Assuming Base64 output is a valid file name. It contains
/and+, so use the URL-safe alphabet for file names and query strings. - Comparing two encodings of the same text and expecting them to match. Different alphabets and padding rules produce different strings for the same bytes.
- Decoding a JWT segment as standard Base64. JWTs use the URL-safe alphabet without padding.
- Pasting Base64 with line breaks into a strict parser. This tool ignores whitespace, but not every parser does.
Sources and standards
Base64 is defined in RFC 4648, which fixes the alphabet, the padding character and the treatment of line breaks. The page follows that specification exactly, so its output can be decoded by any conforming tool rather than only by this one.