Base64 Encode and Decode

How it works

Base64 maps any sequence of bytes onto an alphabet of 64 printable characters, plus = padding. Every 3 bytes become 4 characters, so encoded data is about a third larger than the original. Text is treated as UTF-8 bytes throughout, and both directions update live as you type. Everything runs in your browser.

Encoding is not encryption

Base64 involves no key and no secrecy. Anyone can reverse it instantly, which is the point: it is a transport encoding, not a protection. A base64-encoded password is exactly as secret as the plaintext sitting next to it. When you see it used as obfuscation, treat that as a sign the design ran out of ideas, not as a security control.

The URL-safe alphabet

The standard alphabet includes + and /, which already mean something in URLs and file paths. The URL-safe variant swaps them for - and _ and drops the = padding. JWTs use exactly this alphabet, which is why their parts contain no + or /characters.

When to use it

Good uses: embedding binary in text formats such as JSON, YAML, and XML, data URIs, HTTP Basic auth headers, and email attachments (MIME). The decoder here is deliberately tolerant of missing padding and stray whitespace, because real-world base64 arrives in all shapes. It still rejects input that cannot be valid base64.