Base64 Encoder & Decoder

Why most browser-based Base64 tools mangle your text

The browser's built-in btoa does not accept text. It accepts a string of bytes, meaning every code unit must be 255 or below, so btoa applied to a word with an accent throws an error and applied to certain other input produces the wrong answer. The workaround that circulated for years relied on unescape, a function deprecated since the 1990s. Tools built on either are broken for most of the world's writing systems, and the failure is usually silent mojibake rather than an error.

This tool encodes through TextEncoder into real bytes and then applies the alphabet directly, so Hindi, Chinese, emoji, the rupee sign and accented Latin all round-trip exactly. Decoding runs the same path in reverse and reports failure rather than substituting replacement characters, which means it can tell you honestly when the input was binary rather than text.

Standard or URL-safe

Standard Base64 uses + and /, which are both meaningful inside a URL and inside a filename. RFC 4648 §5 defines the URL-safe alphabet that substitutes - and _, and that is what JWTs, WebPush keys and most token formats actually use. Padding is usually dropped in that context, which is why the padding switch exists - and why a token rejected by one library and accepted by another is very often just this.

Decoding accepts either alphabet regardless of the switch, because somebody pasting a JWT segment wants it decoded rather than corrected.

• Swap moves the output into the input and flips direction, for a round-trip check
• Optional 76-character line wrapping, as MIME requires
• Byte counts, so you can see the 33% size increase encoding costs
• Binary output shown as hex rather than as broken text

Base64 is not encryption

This is worth stating plainly because it underlies a recurring category of security incident. Base64 has no key and provides no secrecy: it is a way of carrying arbitrary bytes through a channel that only tolerates text. Anyone holding an encoded string can reverse it in one step, including this page. A credential that is merely Base64-encoded is a credential in plain text with an extra step.

What it will not do

It does not take file uploads. That keeps the promise on this page simple and literal - there is no upload path to reason about - and a file-to-Base64 conversion is better done with a one-line shell command anyway.

It also does not decode nested or multiply-encoded input automatically, and it will not guess at a string that is nearly Base64. A truncated or corrupted input is reported with the position of the problem rather than partially decoded.