Base64 Encoder and Decoder
Convert text to Base64 and back, with URL-safe output and proper handling of non-Latin scripts.
Processed on your device — no upload
Text is encoded as UTF-8 first, so Arabic, accents and emoji survive the round trip. The browser's own btoa works on bytes and mangles anything above ASCII if used directly.
How to use it
- Choose encode or decode.
- Paste your text.
- Copy the result.
How it works
Base64 represents arbitrary bytes using 64 printable characters. Three bytes become four characters, which is why the output is about a third larger than the input. It is not encryption and offers no protection — anyone can decode it, as this page demonstrates.
The Unicode trap is the reason most Base64 tools are subtly broken. The browser's built-in btoa works on bytes and throws, or corrupts, when handed anything above ASCII. Text here is encoded as UTF-8 first, so Arabic, accented Latin and emoji survive the round trip intact.
URL-safe Base64 swaps + and / — which have meaning in a URL — for - and _, and drops the trailing = padding. It is what JWTs use. Decoding accepts either variant and restores the padding automatically.
Decoding is strict: output that is not valid UTF-8 text is reported as binary rather than returned as replacement characters pretending to be a result.
A worked example
Press Load a sample with encoding selected. The input is مرحبا — Café ☕: Arabic, an em dash, an accented letter and an emoji.
Encode it, then switch to decode and paste the result back. You get exactly the original string. Try the same round trip in a tool that calls btoa directly and it either throws an error or returns mangled text. This is the single most common bug in online Base64 tools.
What Base64 is actually for. Carrying binary data through a channel that only handles text: an image inline in a CSS file as a data URI, an attachment in an email, a certificate in a configuration file, a small file inside a JSON payload.
What it is not for. Hiding anything. Base64 is an encoding, not a cipher, and encoded credentials in a config file are plain text with an extra step. If the content needs to be secret, encrypt it.
Base64 is also where a JWT's readability comes from — each part is URL-safe Base64, which is why anyone can read a token without the signing key.
Questions
What is url safe Base64?
A variant using - and _ in place of + and /, with the padding removed, so the result can sit in a URL unescaped. JWTs use it.
Is this the same as atob and btoa?
Same idea, done correctly. The browser's own atob and btoa work on bytes and mangle anything above ASCII; text here is encoded as UTF-8 first, so Arabic and emoji survive.
Is Base64 encryption?
No. It is an encoding with no key and no secret. Anyone can decode it instantly, as this page shows.
Why does my Arabic or emoji break in other tools?
Because they call btoa directly, which only handles bytes below 256. This tool encodes as UTF-8 first, so any script survives.
What is URL-safe Base64?
A variant using - and _ instead of + and /, with the = padding removed, so the result can sit in a URL unescaped. JWTs use it.
Why is the output bigger than the input?
Because three bytes become four characters — about 33% larger. That is inherent to representing bytes in a 64-character alphabet.
Is my data uploaded?
No. The conversion runs in your browser, which matters when the thing being encoded is a key or a certificate.
What are the = signs at the end?
Padding, so the length is a multiple of four. URL-safe Base64 omits them, and this tool restores them when decoding.
Can I encode a file?
Text files, yes. Binary files such as images are not supported here — encoding one would produce output this tool could not decode back to text.
Why did decoding say it is binary data?
Because the decoded bytes are not valid UTF-8 text — it was probably an image or an archive. Returning replacement characters would have looked like a successful decode.