What is base64 and when do you actually need it?
Base64 is a way to pack any text or bytes into a safe set of 64 characters (A-Z, a-z, 0-9 and two extras). It is the format you reach for whenever something has to travel through a place that only accepts plain text: a URL, a JSON field, an email header, a JWT, an XML attribute.
This tool does the boring part for you in the browser:
- Encode: type any text, get the base64 string. Full UTF-8 support, so Polish letters, emoji, Chinese characters all encode correctly.
- Decode: paste base64, get the original text back. The tool auto-detects the URL-safe variant (where `+` becomes `-` and `/` becomes `_`).
- URL-safe switch for tokens that need to live in a URL without breaking it.
- 76-character line wrap for old MIME-style email bodies.
Live conversion as you type, byte counts and a size ratio on the side. Everything runs in your browser, nothing is uploaded.
How to use it
- Pick a direction: Encode turns text into base64. Decode turns base64 back into text.
- Type or paste into the input box. The result updates live, no button needed.
- In Encode mode flip URL-safe if the output will sit in a URL or a filename. The tool swaps `+` and `/` for `-` and `_` and drops the `=` padding.
- Flip Line wrap at 76 chars for MIME-friendly output (old email standards expect it).
- In Decode mode the tool auto-detects URL-safe input by its character set, you do not need to switch anything.
- Use Copy to grab the output, or Swap to run the result back through the other direction (handy when debugging).
- Below the result you see input size, output size and ratio (base64 is always about 1.33x larger than the source).
When this is useful
Six everyday situations where base64 is the right answer:
- Encoding a token for a URL. You have a session id or a one-time code and need to drop it into a link. Plain bytes break URLs. URL-safe base64 (with `-` and `_`, no padding) survives copy-paste, email clients and link previews.
- Reading a JWT by hand. A JSON Web Token is just three base64-encoded parts joined by dots. Paste the middle part here in Decode mode and you instantly see the payload claims (issuer, expiry, user id). Or skip the manual split with the JWT decoder.
- Stuffing data into a JSON payload. The API accepts JSON only. You need to send a config blob, a chunk of XML or a signed message. Base64-encode it once, drop it into a string field, no escaping headaches.
- Debugging an email header. SMTP headers (subject, from, attachment names with non-ASCII) often arrive as `=?UTF-8?B?...?=`. Paste the base64 part here to see what the sender actually wrote.
- Recovering text from a backup. Some export tools wrap user input in base64 to avoid character encoding issues. Decode it here and you have the original text back, with emoji and accents intact.
- Sending Unicode through a legacy system. An older API treats everything as ASCII. Base64-encode your UTF-8 text on the way in, decode it on the way out, and accented letters and emoji survive the trip.
If you actually need a URL-safe escape for query parameters (not data transport), use the URL encoder. For HTML-context escaping (`<`, `&`, `"` on a page), use the HTML entities encoder.
Questions and answers
No. Base64 is a format, not a secret. Anyone with the string can decode it in one click (this tool does it). It hides values from a casual glance, but it gives zero protection against anyone who actively reads the data. If you need secrecy use proper encryption (AES, age, libsodium). Base64 is for transport, encryption is for privacy.