Base64 Encode/Decode
Encode text to Base64 or decode Base64 back to readable text.
Written by Anil Gautam · Updated
How does Base64 encoding work?
The encoder turns your text into UTF-8 bytes and reads them three at a time. Three bytes hold 24 bits, which split into four 6-bit groups, and each group picks one of 64 characters: A to Z, a to z, 0 to 9, + and /. The word Man, bytes 77, 97 and 110, becomes TWFu. When the input runs out partway through a group of three, = signs pad the output to a multiple of four characters.
Output is about a third longer than the input. Hello OneClickUse is 17 bytes, five full groups plus two leftover bytes, so it encodes to 24 characters ending in one =: SGVsbG8gT25lQ2xpY2tVc2U=. Characters outside ASCII take several bytes in UTF-8. The rupee sign alone needs three, so ₹500 is six bytes and encodes to 4oK5NTAw. Data URLs and email attachments use the same scheme, which is why an embedded image or attached file grows by about a third.
Why does decoding show Invalid Base64 input?
The decoder expects standard Base64. URL-safe Base64, used in JWTs and many web tokens, replaces + and / with - and _. The text <<??>> encodes to PDw/Pz4+ in standard form and PDw_Pz4- in URL-safe form, and only the first decodes here. Swap each - for + and each _ for / before decoding, or paste a whole token into the JWT Debugger, which reads the URL-safe alphabet directly.
Missing = padding is accepted, so SGk decodes to Hi, and spaces or line breaks are skipped, which helps with Base64 copied from emails. If the character count is one more than a multiple of four, as with a lone S, decoding fails. The result must also be valid UTF-8 text, so Base64 taken from an image or PDF usually fails with the same message. This tool handles text; to turn an image into a Base64 data URL, use the Image to Base64 Encoder.
Can Base64 protect a password or API key?
Base64 hides nothing. It has no key, so anyone can reverse it with a tool like this one. HTTP Basic authentication sends user:pass as dXNlcjpwYXNz, and Kubernetes stores Secret values in Base64, so anyone who can read those values can decode them. For a one-way fingerprint of text, the Hash Generator makes SHA-256, SHA-384 or SHA-512 hashes, and the Password Generator creates new passwords. Encoding and decoding here use your browser's built-in btoa and atob functions, so the text is not uploaded.