Skip to main content
AllDevToolsHub
🔐

Base64 Encoder

100% Local

Encode and decode text to Base64 format.

Base64 Encoder

Live Processing

The output is updated in real-time as you type. Base64 encoding uses the standard `btoa()` and `atob()` functions directly in your browser.

Try:

Privacy note

This tool runs entirely in your browser. Your input is never uploaded, logged, or sent to AllDevToolsHub or anyone else, and it keeps working offline once the page has loaded.

How to Use Base64 Encoder

01

Pick Direction

Start in Encode mode for text to Base64, or swap to Decode for Base64 to text.

02

Enter Input

Type or paste text, or upload a file to encode it directly.

03

Read Output

The opposite panel updates in real time as you type, no button to click.

04

Copy or Download

Copy the result to clipboard, or download it as a file.

Base64 Encoder: the essentials

AllDevToolsHub's Base64 Encoder/Decoder is a free, browser-based tool that encodes and decodes Base64 (RFC 4648) and Base64URL strings with proper UTF-8 handling. No installation or account required, all encoding happens locally in your browser. It converts text or binary data to and from Base64, the standard binary-to-text encoding used for embedded images, data URIs, JWT tokens, HTTP Basic auth, and JSON file transfers. API keys, credentials, and proprietary files never touch a server.

Key points

  • Base64 (RFC 4648) maps every 3 bytes to 4 ASCII characters from A–Z, a–z, 0–9, +, /, producing a fixed 33% size overhead plus padding.
  • Base64URL swaps + and / for - and _ and typically drops = padding, making it safe inside URLs, JWT segments, and OAuth tokens without percent-encoding.
  • Base64 is encoding, not encryption, anyone can decode it instantly, which is exactly why HTTP Basic Auth requires HTTPS to be remotely safe.
  • JavaScript's btoa() only accepts Latin-1 and throws on emoji; correct UTF-8 handling requires TextEncoder first, then btoa over the byte array.

When to use it

  • Embedding a small icon directly in CSS as a data:image/svg+xml;base64,... URI to eliminate an extra HTTP request on critical-path pages.
  • Encoding binary file uploads inside a JSON API request when the endpoint doesn't accept multipart/form-data, accepting the 33% size penalty for simplicity.
  • Decoding the middle segment of a JWT to inspect claims during debugging, pasting the header.payload.signature value and reading the JSON payload.
  • Generating HTTP Basic Auth headers (Authorization: Basic <base64 of user:pass>) when scripting against legacy APIs that lack token-based authentication.

Common mistakes

  • Passing a Base64URL string to a strict Base64 decoder and getting an 'invalid character' error because - and _ aren't in the standard alphabet.
  • Calling btoa() on a string containing emoji or non-Latin characters and hitting InvalidCharacterError instead of UTF-8 encoding to bytes first.
  • Base64-encoding multi-megabyte files for transport in JSON, ballooning payload size 33% and exhausting mobile memory when the server could accept multipart.
  • Treating Base64-encoded credentials as 'obfuscated' or 'protected' in source code or logs, anyone with the string has the plaintext in one decode call.

Learn More

Base64 Encoding: When You Should and Shouldn't Use It (2026 Guide)

Read Article
Overview

What is Base64 Encoder?

Quickly convert text or files to Base64 and back. The standard way to represent binary data as ASCII, used for embedding images in CSS or JSON payloads.
FAQ

Frequently Asked Questions

Reference

Technical Deep Dive

Base64 Encoder

Base64 encoding and decoding is a standard way to represent binary data in an ASCII string format. This tool allows you to quickly convert text or files to Base64 and back. Commonly used for embedding images in CSS or sending data over protocols that don't support binary.

Base64 is encoding, not encryption. This page exists so you can inspect Basic Auth headers, data URIs, and JWT segments without sending those strings to base64encode.org.

Paste eyJhbGciOiJIUzI1NiJ9 (a JWT header). You should see {"alg":"HS256"}. That is Base64URL with stripped padding, not the MIME alphabet.

If the output looks like binary noise, you decoded the wrong alphabet. Switch to URL-safe mode before treating the result as JSON.

01 Encoding Variants Matrix

Variant Symbols Standard Primary Use Case
Standard+, /RFC 4648Basic Auth, XML, Email
Base64URL-, _RFC 4648 §5JWTs, OAuth 2.0, URIs
MIME+, /RFC 2045File Attachments

02 The 3-to-4 Processing Pipeline

1
Byte Stream Collection The input text is converted into a UTF-8 byte stream (8-bit octets), grouping data into 24-bit blocks.
2
6-Bit Partitioning Each 24-bit block is sliced into four 6-bit integers, ranging from 0 to 63.
3
Alphabet Mapping Each 6-bit value is mapped to its ASCII counterpart (A-Z, a-z, 0-9, etc.) with necessary = padding.

03 When You Reach for Base64

Base64 earns its place wherever a byte stream has to ride through a channel that only speaks ASCII. It is the wrong choice for bulk transfer and for anything resembling secrecy, keep both of those in mind as you scan the list.

  • 🖼️
    Inline data URIs in CSS and HTML A small SVG sprite or a 4KB favicon embedded as data:image/svg+xml;base64,… saves an HTTP round-trip on the critical path. Webpack's url-loader and Vite's asset pipeline both emit this format below a configurable size threshold.
  • 🔐
    JWT header and payload segments A JWT is three Base64URL-encoded JSON blobs joined by dots. The URL-safe alphabet (-_ instead of +/) and stripped padding are what lets the token sit in an Authorization: Bearer header or a query string without being re-escaped.
  • 📧
    MIME email attachments SMTP is a 7-bit ASCII protocol. A PDF attached to an email is wrapped in a Content-Transfer-Encoding: base64 MIME part with a 76-character line limit (RFC 2045). Every mail client on earth speaks this dialect.
  • ⚠️
    HTTP Basic Auth credentials The Authorization: Basic dXNlcjpwYXNz header is just user:pass Base64-encoded, trivial to decode. It is safe only over HTTPS and only when the password isn't reused. Use Bearer tokens or OAuth where you can.
  • 🚫
    Storing megabyte-sized blobs in JSON Base64 inflates payloads by 33% before gzip even runs. A 5MB image becomes ~6.7MB in transit and bloats your database row size. Use multipart uploads, presigned S3 URLs, or a separate binary endpoint instead.

04 Worked Examples

EXAMPLE 1 · PADDING ARITHMETIC
Three inputs of length 4, 5, 6 bytes:
"Many"   (4 bytes)
"Manys"  (5 bytes)
"Manyso" (6 bytes)

Base64 output:

TWFueQ==
TWFueXM=
TWFueXNv

Every input byte count modulo 3 determines padding: remainder 1 produces ==, remainder 2 produces =, remainder 0 produces no padding. The output length is always ceil(n/3) * 4.




EXAMPLE 2 · STANDARD VS URL-SAFE ALPHABET

Encoding the raw bytes 0xFB 0xEF 0xFF with standard Base64:

++//

The same bytes with Base64URL (RFC 4648 §5):

--__

Feeding ++// into a URL query string requires re-escaping the slashes to %2F. JWTs sidestep this entirely by using the URL-safe alphabet and stripping the = padding.




EXAMPLE 3 · THE 33% OVERHEAD ON A 1MB IMAGE

Input: a 1,048,576-byte PNG.

raw size:     1,048,576 bytes
base64 size:  1,398,104 bytes (+33.3%)
gzip(base64): 1,049,200 bytes (≈ raw)

For already-compressed binaries (PNG, JPEG, PDF):

gzip recovers the alphabet overhead
but not the underlying compression
of the original binary.

Plain text round-trips with almost no penalty after gzip; image data round-trips at ≈ original size. Either way the in-memory inflation is real, keep it off the hot path.




05 Related Tools

Base64 rarely travels alone, it shows up next to JWT decoders, hash output, and URL encoders. These pair naturally with it.

🪪

JWT Decoder

Splits a token on the dots and Base64URL-decodes header and payload in one step.
🔢

Base32 Encoder

Case-insensitive sibling for TOTP secrets and onion addresses, bigger output, friendlier to humans.
🧮

Hex Encoder

When you need to read each byte individually, hash output, file magic numbers, MAC addresses.
✓

Runs 100% in your browser

All processing happens locally. No data leaves your device, no telemetry, no logs, no server round-trips.

Compare With

VS
👤

JWT Decoder

You Might Also Need

RJRahul JalavadiyaFounder & Lead Engineer
Last reviewed 2026-07-29