Encode text to Base64 or decode Base64 back to plain text. Runs entirely in your browser.
A–Z, a–z, 0–9, plus + and /. It takes three bytes at a time — 24 bits — and re-slices them into four 6-bit groups, each becoming one character. When the input does not divide evenly by three, the remainder is padded and marked with one or two = characters at the end.| Context | How Base64 is used |
|---|---|
| HTTP Basic Auth | The Authorization header carries base64(username:password). This is encoding only — over plain HTTP it is trivially readable. |
| Data URIs | Small images and fonts embedded directly in HTML or CSS as data:image/png;base64,… — saves a request but inflates the file. |
| JSON Web Tokens | All three JWT segments are Base64URL. The header and payload are readable by anyone; only the signature is protected. |
| Email attachments | MIME has encoded attachments this way since the early 1990s, because SMTP was designed for 7-bit text. |
| API payloads | Binary fields such as file uploads or certificates inside JSON, which has no native binary type. |
| PEM certificates | The block between BEGIN and END CERTIFICATE is Base64-encoded DER. |
+ and / are hostile to URLs and filenames, so RFC 4648 defines a second alphabet that swaps them out. If a decode fails on a token pulled from a URL, a variant mismatch is the usual cause.| Standard | Base64URL | |
|---|---|---|
| Character 62 | + | - |
| Character 63 | / | _ |
| Padding | = required | usually omitted |
| Used by | MIME, PEM, Basic Auth | JWTs, URL parameters, filenames |
- with + and _ with /, then re-add padding until the length is a multiple of four.btoa() function does not do this — it throws on any character above U+00FF, which is why pasting an emoji or an accented name into a naive encoder produces an error rather than output.No. It is a reversible encoding with no key. Anyone can decode it instantly, so it provides no security and must never be used to protect passwords, keys or personal data.
That is padding. Base64 works on three-byte groups, so when the input length is not a multiple of three the final group is padded — one = for a two-byte remainder, two = for a one-byte remainder.
Most often it is the URL-safe variant, which uses - and _ in place of + and /. Whitespace or line breaks introduced by copying can also break it, as can missing padding.
No — it makes them about 33 percent larger. It exists to make binary data safe to transport as text, never to compress it.
Yes. Text is converted to UTF-8 bytes before encoding, so any Unicode character works — including emoji, which plain btoa() cannot handle.
No. Encoding and decoding run entirely in your browser, so it is safe to use with tokens, certificates and private data.
Only for very small assets such as icons. The 33 percent size increase is not cacheable separately from the page, so for anything sizeable a normal image request is faster.