Base64 Encoder
& Decoder
Encode text, files, and images to Base64 — or decode any Base64 string back to text or a downloadable file. Supports URL-safe mode, data URIs, and chunked output.
Quick Reference — Base64 in Code
btoa('hello')
atob('aGVsbG8=')
Browser & Node.js (v16+)
import base64
base64.b64encode(b'hi')
base64.b64decode('aGk=')
Buffer.from('hi').toString('base64')
Buffer.from('aGk=','base64').toString()
echo -n 'hi' | base64
echo 'aGk=' | base64 -d
Linux & macOS
base64.StdEncoding.EncodeToString([]byte("hi"))
encoding/base64
base64.URLEncoding
base64.urlsafe_b64encode()
Replaces + → - and / → _
Base64 Use Cases for Developers
| Use Case | Example | Notes |
|---|---|---|
| HTML inline images | <img src="data:image/png;base64,..."> | Avoids extra HTTP request for small icons and logos |
| CSS background | background: url("data:image/svg+xml;base64,...") | Embed SVG icons directly in stylesheets |
| HTTP Basic Auth | Authorization: Basic dXNlcjpwYXNz | Base64 of username:password — not encrypted, use HTTPS |
| JWT tokens | eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjMifQ.sig | Header + payload are URL-safe Base64 encoded |
| Email attachments (MIME) | Content-Transfer-Encoding: base64 | Binary files encoded for SMTP transport |
| Kubernetes Secrets | YAML secret values are Base64 encoded | Note: this is encoding, not encryption |
| API binary payloads | JSON field: "image": "iVBORw0KGgo..." | Embed binary file data inside a JSON body |
| Environment variables | Store certificates or keys in env vars | Encode PEM certificates for 12-factor apps |
What is Base64 Encoding?
Base64 is a binary-to-text encoding scheme that represents binary data using 64 printable ASCII characters: A–Z, a–z, 0–9, +, and /. A = character is used for padding to make the output length a multiple of 4.
Base64 is used wherever binary data needs to pass through a text-only channel: email attachments (MIME), embedding images in HTML/CSS as data URIs, HTTP Basic Auth headers, JWT tokens (which use URL-safe Base64), and storing binary data in JSON.
Base64 is not encryption — it is easily reversible. A Base64-encoded string is about 33% larger than the original binary data (every 3 bytes become 4 characters).
URL-safe Base64 (RFC 4648) replaces + with - and / with _ so the encoded string can be used in URLs, filenames, and HTTP headers without percent-encoding. JWT tokens use URL-safe Base64 for the header and payload sections.
How Base64 Encoding Works — Step by Step
Base64 works by converting every 3 bytes of binary input into 4 Base64 characters. Here is how the string Man (3 bytes) encodes to TWFu:
- Convert to binary:
M=01001101,a=01100001,n=01101110 - Concatenate bits:
010011010110000101101110(24 bits) - Split into 6-bit groups:
010011010110000101101110 - Map to Base64 alphabet:
19→T,22→W,5→F,46→u→ outputTWFu
When the input length is not divisible by 3, padding characters (=) are appended to make the output a multiple of 4 characters. One = means 1 padding byte; two == means 2 padding bytes.
Standard vs URL-safe Base64: Standard Base64 uses + and / as the 62nd and 63rd characters, which are unsafe in URLs and HTTP headers. URL-safe Base64 (RFC 4648 §5) substitutes - for + and _ for /, making encoded strings safe to embed in query strings, filenames, and Authorization headers without percent-encoding.
Base64 Security Considerations
Base64 is not a security measure. Any encoded string can be decoded instantly by anyone with access to it. Do not use Base64 to hide passwords, API keys, or sensitive data — it provides zero confidentiality.
Common misuse patterns to avoid:
- Storing passwords as Base64 in a database (use bcrypt or Argon2 instead)
- Sending API keys in a URL query string as Base64 (use Authorization headers with HTTPS)
- Using Base64 as "obfuscation" for JavaScript code (easily reversed, ineffective)
Legitimate security uses: Base64 is the standard encoding for the payload sections of JWT tokens (the signature provides the security, not Base64 itself), and for embedding binary keys in PEM certificates and SSH authorized_keys files.
This tool is 100% client-side. No data you encode or decode is sent to any server. All processing runs locally in your browser using the Web Crypto API and native atob()/btoa() functions.
Base64 — FAQ
= characters are added as padding to make the output length a multiple of 4. One = means 1 byte of padding, two == means 2 bytes.data:image/png;base64,iVBORw.... Used in <img src="..."> or CSS background-image to avoid a separate HTTP request for small images or icons.+ and / which have special meaning in URLs. URL-safe Base64 (RFC 4648) replaces them with - and _. Used in JWT tokens, OAuth tokens, and any Base64 embedded in a URL or filename.Related Developer Tools
| Tool | What you'll find |
|---|---|
| JWT Token Decoder | JWT uses URL-safe Base64 for header and payload — decode and inspect claims |
| YAML ↔ JSON Converter | Convert between YAML and JSON for Kubernetes, GitHub Actions, Docker configs |
| Unix Timestamp Converter | Convert Unix epoch timestamps to human-readable dates |
| Cron Expression Generator | Build and validate cron expressions for scheduled jobs |