RunToolRunBase64 Encoder
Encode or decode text with Base64.
How to Encode and Decode Base64
Paste your text
Enter plain text to encode, or a Base64 string to decode.
Switch direction as needed
Encode and decode buttons transform instantly in your browser.
Copy the result
One click puts the output on your clipboard.
Encoding is not encryption
Base64 is a way of representing binary data using 64 printable characters. It is completely reversible by anyone, with no key and no secret. Anything encoded this way is as readable as plain text to anyone who recognises the format — which everybody does, because the trailing equals signs give it away instantly.
This matters because Base64 is regularly mistaken for a security measure. A password, token or API key encoded in Base64 is stored in plain text with an extra step. If something needs to be secret, it needs encryption; if it needs to be verified, it needs hashing.
Why it exists
Many older systems were built for text and mangle arbitrary bytes: email transport, some HTTP headers, XML and JSON documents, URLs. Base64 exists so binary data can travel safely through those channels by using only characters everything agrees on.
That is the whole purpose. Email attachments are Base64 internally. Data URIs embedding an image in a stylesheet are Base64. Basic HTTP authentication is Base64 — which is exactly why it must only be used over HTTPS, since it provides no protection whatsoever on its own.
The size cost
Base64 represents three bytes with four characters, so encoded data is roughly 33% larger than the original, plus padding. That is a real cost when embedding images in HTML or CSS, and it is why inlining large assets makes pages heavier rather than faster.
Compression does not recover it either. Base64 output compresses noticeably worse than the binary it came from, so an encoded file inside a compressed transfer is worse on both counts.
Unicode, and the classic bug
The browser's built-in encoding function only accepts characters in the Latin-1 range and throws an error on anything else, which is why naive implementations break the moment someone types Turkish, Greek, Cyrillic, Arabic or an emoji.
The correct approach converts the text to UTF-8 bytes first and encodes those bytes. This tool does that, so Turkish characters and emoji survive a round trip intact. If another tool has ever mangled your text through Base64, this is almost certainly why.
Variants, and where this runs
Standard Base64 uses `+` and `/`, both of which have meaning in URLs. The URL-safe variant substitutes `-` and `_` and usually drops the padding. They are not interchangeable — decoding a URL-safe string with a standard decoder fails or produces garbage, which is a frequent and confusing bug when moving tokens between systems.
Encoding and decoding happen entirely in your browser. Given how often people paste tokens, credentials and internal payloads into Base64 tools, that is the property that actually matters here.