Base64 Decode and Encode

What is Base64 encoding?

Base64 is a way to write any bytes using only 64 safe text characters: A–Z, a–z, 0–9, + and /, with = for padding. It exists so binary data (images, keys, file attachments) can travel through systems built for text, such as email, JSON, HTML and URLs.

The encoder reads the input three bytes at a time. Three bytes are 24 bits, and 24 bits split evenly into four 6-bit pieces. Each 6-bit piece is a number from 0 to 63, and that number picks one character from the Base64 alphabet. When you base64 decode, the same steps run backwards: four characters give back three bytes.

Because every 3 bytes turn into 4 characters, Base64 output is about a third larger than the input. A 3 MB image becomes roughly 4 MB of text. That overhead is the price of being able to paste binary data anywhere text goes.

• Email attachments are Base64 inside MIME messages, wrapped at 76 characters per line.
• Data URIs embed small images and fonts directly in HTML or CSS as data:image/png;base64,….
• JSON Web Tokens (JWTs) are three Base64URL parts joined by dots.
• API payloads and config files carry certificates, keys and file contents as Base64 strings.
• HTTP Basic auth sends username:password as Base64 in the Authorization header.

How to decode Base64 online, step by step

To decode Base64 online, paste the string into the input box with Decode selected. The result appears in the right-hand box within a fraction of a second, and the status line tells you what the bytes turned out to be: UTF-8 text, an image, a PDF, a ZIP archive, or raw binary.

Behind that, this base64 decode tool does a few things that a bare atob() call does not:

1. Strips the wrapping. Spaces, tabs and line breaks are ignored, so you can paste wrapped MIME text or a PEM block body. A leading data:…;base64, prefix is removed and its MIME type is remembered.
2. Checks every character. Anything outside the alphabet stops the decode, and the error gives the position, line and column. The “Show the problem” button selects that character in the input.
3. Detects the alphabet. Standard (+ /) and URL-safe (- _) input both work. Mixing the two is flagged, because that usually means two strings were pasted together.
4. Checks the length. A valid string can never leave exactly one character over in its last block of four, so a truncated copy-paste is caught instead of silently producing a wrong final byte.
5. Reads the bytes correctly. The output is decoded as UTF-8, so accents, Chinese, Arabic and emoji come out intact.

Working with a decoded JSON payload? Paste it into the JSON formatter to validate and pretty-print it. Comparing two decoded configs is quicker in the diff checker.

Why does Base64 end with = or ==?

The = signs are padding. Base64 works in blocks of three input bytes, and when the input length isn't a multiple of three, the last block is short. The encoder adds zero bits to finish the last character, then pads the output with = so its length is a multiple of four.

Padding is optional in many places: RFC 4648 lets specifications drop it, and JWTs always do. This decoder accepts input with or without padding, but rejects misplaced padding, more than two = signs, or a lone leftover character, since those only come from damaged input.

Base64 vs Base64URL: which one do you have?

Base64URL is Base64 with two characters swapped so the result is safe in URLs and file names: - replaces + and _ replaces /. It is defined in section 5 of RFC 4648 and is what JWTs, WebAuthn and many APIs use. Padding is usually left off.

You don't need to tell the decoder which one you have. It spots - or _ and switches to the URL-safe alphabet automatically. To produce Base64URL, switch to Encode, tick URL-safe and untick padding.

How to decode a Base64 image, or turn an image to Base64

To base64 decode an image, paste the string or the whole data:image/…;base64, URI in Decode mode. The tool reads the first bytes, recognises PNG, JPEG, GIF and WebP by their signatures, shows a preview with the pixel size, and lets you download it with the right file extension.

Going the other way, image to Base64 takes one drop: drag the file onto the file box, and tick “Output as a data: URI” if you want a string you can paste straight into HTML or CSS. The MIME type comes from the file itself.

<img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQ..." alt="Logo">

.icon { background-image: url("data:image/svg+xml;base64,PHN2Zy..."); }

Why btoa() breaks on emoji, and how to encode text correctly

Base64 encodes bytes, not characters, so text must first become bytes. The browser's built-in btoa() only accepts characters in the Latin-1 range and throws an InvalidCharacterError on anything else, including emoji and most non-Latin scripts. atob() has the mirror problem: it returns one character per byte, so UTF-8 text comes back garbled.

The fix is to convert text to UTF-8 bytes with TextEncoder before encoding, and to turn decoded bytes back into text with TextDecoder. That's what this tool does in both directions, which is why “héllo 👋” round-trips cleanly.

// Encode text → Base64 (UTF-8 safe)
const bytes = new TextEncoder().encode("héllo 👋");
const b64 = btoa(String.fromCharCode(...bytes)); // fine for short strings

// Base64 → text
const back = Uint8Array.from(atob(b64), (c) => c.charCodeAt(0));
const text = new TextDecoder().decode(back);

// Newer browsers: built-in helpers (Baseline 2025)
const u8 = Uint8Array.fromBase64("aMOpbGxvIPCfkYs=");
const out = u8.toBase64({ alphabet: "base64url", omitPadding: true });

Uint8Array.fromBase64() and toBase64() became Baseline in September 2025, according to MDN, so older browsers still need the TextEncoder route. Both support the base64url alphabet.

Is Base64 encryption?

No. Base64 is an encoding, not encryption. It has no key and no secret: anyone can base64 decode it in one step, with this page or a one-line command. It only changes how data is written, not who can read it.

Base64 encode and decode on the command line and in code

Every major platform can encode and decode Base64 without a website. These are the commands to reach for when the data is already in a terminal or a script.

# Linux (GNU coreutils) and recent macOS
echo -n 'hello' | base64          # aGVsbG8=
echo 'aGVsbG8=' | base64 -d        # hello
base64 -w 0 photo.png > photo.txt  # GNU: no line wrapping

# Python
python3 -c "import base64; print(base64.b64decode('aGVsbG8=').decode())"

# PowerShell
[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aGVsbG8='))

# Node.js
Buffer.from('aGVsbG8=', 'base64').toString('utf8')

Watch for two traps. echo without -n adds a newline, which changes the output. And GNU base64 wraps long output at 76 characters unless you pass -w 0. Python's base64.urlsafe_b64decode handles Base64URL but still expects padding, so add = signs back first.

If you do this often, a browser extension can keep a decoder one click away. Browse the developer tools category or the extensions for developers list.

What to look for in an online Base64 encode decode tool

Any base64 decode online page will handle “hello”. The differences show up with real data. Check these before you trust one with a token or a file:

Where the work happens

The page should convert in your browser. If it has a “submit” step that reloads the page, your input went to a server. This tool never sends it anywhere.

UTF-8 in both directions

Encode “naïve ☕” and decode it back. If the result changes or the page errors, it is using raw btoa/atob.

Base64URL and missing padding

Decode a JWT segment. A tool that demands = padding or rejects - and _ can't read modern tokens.

Useful errors

A good decoder says which character is wrong and where. A bare “invalid input” leaves you hunting through thousands of characters.

Binary output

Decoded images and files should preview or download with the right extension, not dump unreadable symbols into a text box.

This base64 decode encode online tool was built to pass all five. You can decode encode base64 text back and forth with Swap, encode and decode base64 files, or decode base64 encoding inside a data URI, all on one page. Every base64 decode and encode step stays in your tab.