What Base64 is for

Base64 rewrites arbitrary bytes using only 64 characters that survive being treated as text:A–Z, a–z, 0–9 and two more. It exists because a great many systems — email bodies, JSON fields, URLs, XML attributes, cookies, environment variables — accept text and mangle or reject raw bytes. Encoding first means an image, a PDF or a signature can travel through them unharmed.

It is not encryption. Anyone can decode Base64, including this page, without a key or a password. It hides nothing; it only makes bytes safe to transport.

The size it costs

Every three bytes become four characters, so Base64 is about 33% larger than what went in — plus a little more if you wrap the lines. That's the trade: safe transport for a third more bandwidth. It's also the reason inlining a large image as a data URI is usually a poor idea. Under a couple of kilobytes it saves a request; above that it bloats the page and can't be cached separately.

Accents, emoji, and why `btoa` isn't enough

Base64 encodes bytes, not characters, so text has to be turned into bytes first — and which bytes depends on the encoding. The browser's built-in btoa only accepts characters up to 255, which is why pasting "café" into a naive tool throws an error. This one converts to UTF-8 first, so accents, Greek, Japanese and emoji all encode and come back identical. It's the same thing every server does, so the result matches.

The two alphabets

Standard Base64 uses + and / for its last two characters. Both mean something else in a URL, so URL-safe Base64 swaps them for - and_, and usually drops the = padding too. That's the variant used by JSON Web Tokens, OAuth, and anything that puts a value in a query string or path.

Decoding accepts either without being told which. If a value contains both +/ and-_, that isn't a third alphabet — it means two different values have ended up joined together, and this says so rather than returning nonsense.

Padding, and the lines

The = at the end pads the output to a multiple of four characters. It carries no data; it only tells a decoder how many bytes the last group holds. Plenty of systems strip it, so decoding here adds it back when it's missing.

Line breaks are the same story. MIME wraps at 76 characters and PEM at 64, both because old mail software broke on long lines. Wrapped or not, it decodes the same — the line breaks are ignored on the way in.

When what comes out isn't text

Base64 is used for files at least as often as for text, so a decoded value is frequently a PNG, a PDF, a zip or a Word document. Showing those as characters produces a screenful of rubbish. Instead the decoded bytes are inspected — every common format announces itself in its first few bytes — and what it is gets named, previewed if it's an image, and offered as a download with the right extension.

Is it private?

Yes. Everything happens in JavaScript inside this page. Text and files are never uploaded, never logged, and never sent anywhere, because there is no server to send them to. You can disconnect from the internet after the page loads and it keeps working.

Frequently asked questions

Can I decode a JWT with this?

You can — a token's header and payload are each URL-safe Base64, so pasting one section in returns its JSON. For a whole token at once, with expiry dates and signature checking, use theJWT decoder instead.

Why did my decoded text come out as strange symbols?

Usually because the original bytes weren't UTF-8 text — they were a file, or text in an older encoding such as Latin-1 or Shift-JIS. If it's a file, this page will say so and offer it as a download rather than showing it as characters.

Is Base64 the same as encryption or hashing?

Neither. Encryption needs a key and is meant to be undoable only with one. A hash is one-way and can't be undone at all. Base64 is a reversible re-spelling of the same data, with no secret involved.

How big a file can I encode?

Files up to 25 MB. The limit is about what the browser can hold as a string without becoming unpleasant — the result is a third larger again, and a text box with 34 million characters in it is slow in any browser.