Base64 Encoder and Decoder

What Base64 does

Base64 represents arbitrary bytes with characters that text-based systems can carry safely: A–Z, a–z, 0–9, + and /, plus = for padding. It is used when formats such as email, JSON, URLs and XML need to carry binary data as text.

Each three-byte input group becomes four output characters, so Base64 adds about 33% to the original byte count. That overhead is one reason large images are usually better served as separate files than embedded as data URIs.

Base64 and Base64url

Standard Base64 uses +, / and = padding. Those characters can need special handling in URLs. Base64url replaces + and / with - and _, and it usually omits the padding.

A standard Base64 decoder may reject a JWT segment because Base64url uses - and _. Select Use Base64url for that input. The decoder restores omitted padding automatically.

Why Unicode needs an extra step

The browser’s btoa() function accepts only Latin-1 characters. Passing an emoji, a Chinese character or a curly apostrophe directly to it throws an error:

btoa('café ☕')
    // InvalidCharacterError occurs for code points
    // outside the Latin 1 range.

Convert the text to UTF-8 bytes before encoding it. To decode, reverse those steps and interpret the bytes as UTF-8. This tool follows that process for emoji and accented text:

function toBase64(text) {
  const bytes = new TextEncoder().encode(text);      // Encoded UTF 8 bytes
  let binary = '';
  for (const b of bytes) binary += String.fromCharCode(b);
  return btoa(binary);
}

function fromBase64(b64) {
  const binary = atob(b64);
  const bytes = Uint8Array.from(binary, c => c.charCodeAt(0));
  return new TextDecoder('utf-8').decode(bytes);
}

Common uses

• HTTP Basic authentication: the Authorization: Basic header contains username:password encoded as Base64. It provides no protection without HTTPS.
• JWTs: the header and payload are Base64url-encoded JSON. Use the JWT decoder to inspect their claims.
• Data URIs: data:image/png;base64,… embeds a file in HTML or CSS. It avoids a separate request but adds Base64 overhead and prevents separate caching.
• Email attachments: MIME represents binary attachment data as Base64 text.
• Kubernetes secrets: values in a Secret manifest are Base64-encoded for transport, not protected. Anyone who can read the manifest can decode them.
• SSH keys and certificates: the content between the header and footer of a PEM file is Base64-encoded DER.

Using Base64 from the command line

# Encode text without the newline from echo
echo -n 'hello world' | base64

    # Decode text
echo 'aGVsbG8gd29ybGQ=' | base64 --decode

    # macOS uses the capital D option
echo 'aGVsbG8gd29ybGQ=' | base64 -D

    # Encode a file into another file
base64 -i logo.png -o logo.txt

    # Decode a Kubernetes secret value
kubectl get secret my-secret -o jsonpath='{.data.password}' | base64 --decode