Input
Output
0
Input bytes
0
Output bytes
—
Ratio
Encode and decode Base64 instantly. Private — nothing leaves your browser.
Base64 is how binary data survives systems built for text. It re-expresses any byte stream using 64 safe characters (A–Z, a–z, 0–9, +, /), three bytes becoming four characters — which is why encoded data is always ~33% larger than the original. You meet it in email attachments (MIME), data-URI images embedded in CSS, JSON APIs smuggling binary payloads, and the header.payload.signature segments of every JWT.
The most common Base64 mistake is treating it as secrecy. It's a reversible transformation with no key — anyone can decode it, including this page. If you can read a JWT's claims by pasting it here, so can anyone who intercepts it. Base64 solves a transport problem, never a confidentiality problem; for secrets, you want actual encryption.
Standard Base64 uses + and /, both of which have special meanings in URLs. The URL-safe variant (RFC 4648 §5) substitutes - and _, and usually drops the = padding. If a decoded token looks corrupted, variant mismatch is the first thing to check — this tool handles both.
Because decoding happens locally, you can inspect suspicious Base64 from a phishing email or an unknown config file without sending it to a third-party server — a small but real operational-security win.
7 Claude prompt systems — prompt engineering, cold outreach, launches, demos, SEO and more. The Complete Suite: all 7 for $297 (vs $679 apart). One-time, yours forever.
Explore the Complete Suite — $297 →