Base64 Encoder / Decoder
Paste in either direction — encode or decode. UTF-8 safe, so emoji and accents survive the round trip. Nothing is sent anywhere, which matters since Base64 blobs often contain tokens and credentials.
Processed in your browser — tokens and data never leave this page.
Where you meet Base64 in the wild
Inline images in HTML/CSS (data:image/png;base64,…), the payload sections of JWT tokens,
email attachments under the hood, API keys in config files, and basic-auth headers. Decoding the middle
chunk of a JWT here is a quick way to see what a token actually claims — and a good reminder of the
security FAQ above: if you can read it, it was never secret.
Common questions
What is Base64?
A way to represent any data using only 64 safe characters (A–Z, a–z, 0–9, +, /) so it survives systems built for plain text — email attachments, JSON payloads, data URLs, JWT tokens. It's encoding, not encryption: anyone can decode it.
Is Base64 secure?
No — and this is the most important fact about it. Base64 is a transport format, not protection; decoding requires no key. Never use it to "hide" passwords or secrets. If you can paste it here and read it, so can anyone.
Why does my Base64 fail to decode?
Usually missing characters from a partial copy, stripped = padding at the end, or it's actually Base64URL (used in JWTs, with - and _ instead of + and /). Check you copied the whole string.
Does this handle emoji and special characters?
Yes — encoding is UTF-8 aware, so emoji, accents, and non-Latin scripts round-trip correctly. (The naive JavaScript approach corrupts them; this tool does it properly.)