Base64 Encode and Decode

Some systems can only carry plain text. An email header, a data URL in a web page, a token in an API call, a value in a YAML or JSON config file: each of these expects letters and numbers, not raw bytes. Base64 solves that by rewriting any data using just sixty-four safe characters, so it can travel through a text-only path and come out the other side unchanged.

The trade is size. Every three bytes become four characters, so the output is about a third bigger than what you started with. That is the cost of safe passage, and it is why Base64 is used for small values like keys, tokens and tiny images rather than for large files.

Plenty of people come here looking for a way to decrypt Base64. There is nothing to decrypt. Base64 is a way of writing data, not a way of locking it.

Decoding needs no key, no password and no account. A decoder is all there is, and this page is one.

You can prove it in a second. Paste aGVsbG8= in the box and choose Decode. The word hello appears at once, and the tool says Decoded to text. Nothing was unlocked, because nothing was locked.

This matters most when the value is not yours. A key, a password or a customer name may sit in Base64 inside a log file or a web address. Treat it as text in the open, because that is what it is.

Both directions sit on the same page, because you almost never need only one. Paste text, read the Base64 on the right, then tap Swap. The result moves into the left box and the direction flips, so you decode what you just encoded and see your original text come back. That is the quickest way to prove a value survived a copy and paste, which is where most Base64 problems actually start.

The counter under each box shows the character count and the size in bytes, so the one third growth is visible rather than something you have to take on trust.

Standard Base64 uses plus and slash as two of its sixty-four characters. Both cause trouble outside plain text. A slash separates parts of a web address, and a plus can be read as a space in a query string, so a token pasted into a link can arrive damaged. The URL-safe alphabet swaps those two for minus and underscore, which pass through links and filenames untouched.

Decoding accepts either alphabet without being told which one you used, so you can paste a token from a link and it just works. If you are working with query strings rather than data, the URL encoder and decoder is the tool you want instead.

Base64 works in groups of four characters. When your data does not divide evenly, one or two equals signs are added at the end to fill the last group. Turn off Keep padding and those are removed, which some APIs and JSON web tokens expect. Decoding here works either way, because the missing padding can be worked out from the length.

Line wrapping is the other old convention. Email and PEM certificate formats want short lines, traditionally sixty-four or seventy-six characters. Set Wrap every N characters to match whatever your target format asks for, or leave it at zero for one continuous line.

The same conversion exists everywhere, and the results match what this page shows.

On macOS or Linux, running printf 'hello' | base64 prints aGVsbG8=, and feeding that back through base64 -d returns hello.

Python does the same job with b64encode and b64decode, while Node uses Buffer.from. Both give that same short string.

Browsers have btoa and atob, which are the old shortcut. They break above the basic Latin range, so an accent or an emoji comes back wrong. This page reads your text as UTF-8 first, so those characters survive.

So use the page when you want to see a value and check it by eye, and use the command when it belongs in a script. Neither one sends your data anywhere.

Nearly always because something came along for the ride. A quote or a bracket copied with the surrounding code, a stray character at the end, or text that was cut off partway through. Rather than failing with a vague complaint, this tool names the exact character that cannot appear in Base64, so you know what to delete. If the length itself is impossible, it says the text looks cut off instead, because that is a different problem with a different fix. There is a third message, and it catches the commonest confusion of all. Paste the Base64 of an image or a PDF and the text is perfectly valid, so it does decode, but what comes out is bytes rather than words. The tool says exactly that: That Base64 decoded to binary data, not text. It is probably an image or a file, not a message. Nothing is wrong with your paste. It simply is not text.

Spaces, tabs and line breaks are never a problem. They are ignored before decoding, so Base64 wrapped across many lines pastes in fine exactly as you found it.

A picture inside a web page is often written as a data URL. It begins with something like data:image/png;base64, and the Base64 starts after the comma. Paste the whole thing here and decoding stops with a precise complaint: That is not valid Base64. The character ":" cannot appear in Base64 text.

The message is right. That prefix is not Base64 at all. Delete everything up to and including the comma, and what remains will decode.

Use this page to check that a data URL is well formed. It also reads a token or a certificate out of a config file. To change a picture into another format, reach for an image tool instead.

To turn Base64 back into a real file, a terminal is the shortest route. On macOS or Linux, base64 -d in.txt > logo.png writes the bytes straight to disk. That is one command. It also keeps a large file off any web page, including this one.

Yes, and that is the point of building it this way. Many free Base64 sites send whatever you paste to their own server to do the work, which means your API key, session token or private note is now sitting in someone else's logs. This page does the conversion in your browser, so the text never leaves your device.

One honest warning that has nothing to do with this site: Base64 is not encryption. It is trivially reversible by anyone who sees it. Encoding a password does not protect it. If you need secrecy, encrypt first, then encode the encrypted result. For a wider look at what runs locally here, see the developer tools or convert structured data with XML to JSON.