About this tool
Base64 turns up all over API testing: Basic auth headers, JWT segments, file uploads in JSON bodies, data: URLs and encoded config values. The browser’s built-in btoa fails on any character outside Latin-1, so this tool encodes text as UTF-8 bytes first and decodes back with a strict UTF-8 check. It accepts standard and URL-safe alphabets, tolerates missing padding and line breaks, and explains exactly why invalid input fails. Files are read locally and can be output as raw Base64 or as a data: URL.
How to use it
- Choose Encode or Decode.
- Type or paste text; the output updates immediately. Tick URL-safe for Base64URL (- and _ instead of + and /, no padding).
- To encode a file (up to 5 MB), click “Encode a file” and optionally output a data: URL.
- When decoding binary data such as an image, the tool identifies common file types and lets you download the bytes.
Base64 Encoder / Decoder FAQ
What is the difference between Base64 and Base64URL?
Base64URL replaces + with - and / with _, and usually drops the = padding, so the value is safe in URLs, filenames and JWTs. The decoder here accepts either alphabet automatically, but not a mix of both in one string.
Why does my decoded text look garbled elsewhere?
Usually the text was encoded from a different character set (for example Windows-1252) or the tool you used decoded bytes as Latin-1. This tool always uses UTF-8 and reports bytes that are not valid UTF-8 instead of showing replacement characters.
Is Base64 a way to protect secrets?
No. It is reversible by anyone. A Basic auth header or a Kubernetes secret in Base64 is effectively plain text, which is worth flagging if you find one in logs or screenshots.