Base64 Converter

How to use this Base64 converter

1. Choose "Encode" or "Decode".
2. Paste your text into the input box.
3. The result updates instantly on the right.

What is Base64?

Base64 is a way of representing binary data using only 64 printable characters. It is commonly used to embed images in CSS/HTML, send binary data over text-based protocols like email (MIME), and store data in JSON or XML safely.

Is this safe to use for sensitive data?

Base64 is encoding, not encryption. Anyone can decode it instantly, so never use it to protect passwords or secrets. This tool runs entirely in your browser; nothing you type is sent to any server.

How Base64 encoding actually works, byte by byte

Base64 works by regrouping data's underlying bits rather than translating characters one at a time. It takes input 3 bytes (24 bits) at a time and re-splits those same 24 bits into four 6-bit chunks instead. Since 6 bits can represent exactly 64 distinct values (2^6), each chunk maps directly to one character from Base64's fixed 64-character alphabet — uppercase A-Z, lowercase a-z, digits 0-9, plus two more symbols (typically + and /) to reach 64. When the input's length isn't a clean multiple of 3 bytes, the final group is padded with one or two "=" characters, which is why encoded output so often ends in one or two equals signs — they're not arbitrary, they signal exactly how many padding bytes were added to complete that last group of four.

Why the 33% size increase is mathematically unavoidable

Base64's roughly 33% overhead isn't an inefficiency that could be optimized away — it's a direct mathematical consequence of the 3-bytes-in, 4-characters-out regrouping described above. Every 3 bytes (24 bits) of original binary data becomes 4 text characters, and since each of those output characters typically takes up 1 byte when stored or transmitted as text, 3 bytes of input reliably becomes 4 bytes of output — a 4/3 ratio, or exactly 33.3% larger. This tradeoff exists because Base64's entire purpose is representing arbitrary binary data using only safe, printable ASCII text characters, so it deliberately spends some extra space in exchange for compatibility with systems and protocols that can't reliably transmit raw binary bytes.

Standard Base64 versus URL-safe Base64

Standard Base64's default alphabet includes + and / as its final two characters, and both happen to carry special meaning inside a URL — + is sometimes interpreted as a space, and / is a path separator — which causes real problems if standard Base64 output is dropped directly into a URL or filename without modification. A commonly used variant called Base64URL solves this by substituting - and _ in place of + and /, both of which are safe in URLs and filenames, and it commonly also drops the trailing "=" padding altogether, since padding length can be inferred from context in most URL-safe use cases. JWTs (JSON Web Tokens), for example, use Base64URL specifically because tokens are frequently passed around inside URLs and HTTP headers, where standard Base64's characters would need extra escaping.

The most common Base64 misconception — and where it actually comes from

Base64's biggest recurring misuse is being mistaken for a security measure, and understanding why the confusion happens helps avoid it. Base64 has no key, no secret, and no randomness of any kind involved in the process — encoding and decoding are entirely mechanical, reversible transformations that anyone can perform instantly with any standard library or a tool exactly like this one, with zero barrier at all. The confusion likely persists partly because Base64-encoded text looks unfamiliar and unreadable at a glance, which superficially resembles what encrypted or obfuscated data looks like — but that resemblance is purely cosmetic. Base64 was designed for compatibility (letting binary data pass safely through text-only systems like early email protocols), never for confidentiality, and it should never be relied on to protect anything actually sensitive.

Limitations of this tool

This tool encodes and decodes using the standard Base64 alphabet (with + and /), not the URL-safe variant (with - and _) described above — if you need URL-safe output for something like embedding a value directly in a link, you'll need to substitute those characters manually afterward. It handles full Unicode text correctly, including emojis and accented characters, but it doesn't currently support directly uploading and encoding binary files (images, PDFs, etc.) — only text you paste or type. Everything happens locally in your browser using JavaScript's built-in encoding functions, so nothing you enter is ever transmitted anywhere.