Skip to content
WGX

Base64 Encoder & Decoder

Turn text into Base64 and Base64 back into text.

Direction

What Base64 is for

Some channels only carry text: an email body, a JSON string, a URL, an HTML attribute. Base64 is how bytes travel through them — every three bytes are rewritten as four characters from a set of 64 that nothing along the way will mangle. It is why an image can live inside a stylesheet, and why the middle of a JSON Web Token looks like nonsense until you decode it.

Base64 is not encryption

This is worth saying plainly, because the mistake is common and expensive. Base64 is a representation, not a lock. Anyone who sees it can reverse it instantly — this page does it as you type, with no key and no password. Putting a password in Base64 to "hide" it hides nothing at all; it only makes it slightly less obvious to a person skimming.

The accent problem

Most Base64 tools on the web break the moment you give them a name with an accent in it, or an emoji. The reason is that the browser's own btoa works on bytes rather than characters and refuses anything above U+00FF, so a tool that hands it a string directly fails on most of the world's text. The fix is to encode to UTF-8 first, which is what happens here: Café 🙂 goes there and comes back unchanged.

URL-safe Base64, and JWTs

Standard Base64 uses +, / and =, and all three cause trouble in a URL. The URL-safe variant swaps in - and _ and leaves the padding off. Tokens use it, so a JWT segment pasted here decodes without you having to add the padding back — and what comes out is usually JSON, which the JSON Formatter will lay out for you.

Pasting a whole token

You do not have to pull a JWT apart first. Paste the whole thing, dots and all, and the payload appears as the result, with the header, the algorithm and the signature under it, and iat, nbf and exp read back as dates — "expired 3 hours ago" rather than 1789012345. An expiry that has passed, and an algorithm of none, are called out.

Reading a token is not checking it. The signature is never verified here, because verifying needs the key it was signed with, and a page that has only the token does not have the key. Anyone can change a payload and re-encode it. Read the claims, check the expiry, and take nothing here as evidence that the token is genuine.

It costs about a third

Three bytes in, four characters out: Base64 is roughly 33% larger than what went into it, plus padding. That is the price of the safe alphabet, and it is why embedding images as data URIs makes a page heavier than linking to the same files.

Nothing is uploaded

Your browser does the work; nothing is sent anywhere, and the test suite for this page watches the requests the tool itself makes and fails if any of them could carry the text. Given that the two things most often pasted into a Base64 tool are an access token and an authorization header, that is not a detail.

Questions

How do I decode a Base64 string?

Choose "Base64 to text" and paste it in. The result appears as you type. Line breaks, missing padding and the URL-safe alphabet are all handled for you, so a segment copied out of a JWT works without being tidied up first.

Is Base64 encryption?

No, and treating it as though it were is a genuine security mistake. Base64 is a way of writing bytes with 64 safe characters; anyone can reverse it in a second, exactly as this page does. It hides nothing. If something must be secret, it has to be encrypted.

Why do accented letters and emoji break other Base64 tools?

Because the browser function they call, btoa, works on bytes rather than characters, and throws on anything above U+00FF. The text has to be turned into UTF-8 bytes first. This page does that, so "Café 🙂" encodes and decodes back to itself.

What is base64url, and when do I need it?

A variant that uses - and _ in place of + and /, and usually drops the = padding, so the result is safe in a URL or a filename. It is what JWTs use. Tick "URL-safe" when encoding; decoding accepts either form without being asked.

How do I decode a JWT?

Choose "Base64 to text" and paste the whole token in — all three parts, dots included. It is recognized automatically: the result box holds the payload, and the full reading appears beneath it, so there is nothing to split into its parts yourself.

What does decoding a JWT show?

The header and the payload, read back as formatted JSON rather than the raw Base64url text, along with the algorithm. Claims that are dates — iat, nbf and exp — get a label of their own and are followed by how far off they are, like "3 hours ago" or "in 55 minutes," not only the raw number. The signature is shown too, as the raw text of the third part, but only that: it is not checked against anything.

Is decoding a JWT the same as verifying it?

No. Decoding reads the header and the payload, and anyone can do that with nothing but the token — that is all its own encoding hides. Verifying checks the signature against the secret or public key it was signed with, and no tool that has only the token can do that, this one included. Anyone can change a payload and re-encode it, so having a token proves nothing by itself: read the claims and check the expiry, but take nothing shown here as evidence the token is genuine.

Is it safe to paste a token here?

It is decoded in your browser and never sent anywhere — there is no server for it to reach, and the test suite for this page watches every request the tool makes and fails if one of them could carry what you typed. A token is still a credential, so treat it the way you would any other: do not paste one from a system you do not trust, and do not hand the decoded result to anyone who should not see the claims inside it.

Does Base64 make my data bigger?

Yes, by about a third: every three bytes become four characters. That is the price of sending binary through a channel that only carries text, and it is why images embedded as data URIs weigh more than the files they came from.

Is what I paste sent anywhere?

No. Everything happens in your browser. That matters here more than almost anywhere: the two things people most often paste into a Base64 tool are an access token and a basic-auth header, and both are credentials.