Base64 Encode & Decode Online — Standard, URL-Safe, Files

Guide

About Base64 Encode / Decode

Encode and decode Base64 (and Base64url) instantly. Drop a file to encode it as a data URL, paste a Base64 string to decode and preview images inline, or run batch mode with one entry per line. The tool auto-detects standard vs URL-safe input so you never hit a padding error.

What Base64 actually solves

Base64 maps 3 binary bytes onto 4 ASCII characters. The alphabet — A-Z, a-z, 0-9, plus two specials — is safe across systems that mangle high bytes (email, JSON, URLs, XML). It is not encryption. It is the encoding you reach for when a transport channel insists on text but your data is binary.

There are two common variants:

Standard (RFC 4648 §4) — uses + and /, requires = padding
URL-safe (RFC 4648 §5) — uses - and _, padding optional

JWTs, JWKs, OAuth state parameters, and most modern web APIs use URL-safe Base64. Email MIME and most older formats use standard. Our decoder normalizes either input automatically.

How to use this tool

Encode — paste any text or drop a file. UTF-8 strings are encoded byte-by-byte; files become data URLs with the correct MIME prefix.

Decode — paste a Base64 string. We auto-detect variant, decode, sniff the result. If it looks like an image (PNG, JPEG, GIF, WebP, SVG), we render an inline preview. Text is shown as-is with a copy button.

Batch — toggle batch mode and put one input per line. Perfect for log mining where each line carries an encoded payload.

Common workflows

Embed an image in CSS. Drop the icon, copy the data URL, paste into a background-image: url(...) rule. Use sparingly — data URLs bloat CSS and skip browser caching.

Decode a JWT segment by hand. Copy any of the three segments from the JWT Decoder, paste here in URL-safe mode, see the raw JSON without dedicated tooling.

Verify a webhook signature. Many providers Base64-encode the HMAC for the X-Signature header. Decode here to compare against your local computation in the HMAC Generator.

Why local matters for Base64

Base64 strings often contain credentials — basic-auth headers, OAuth state, JWT payloads, encrypted tokens. Pasting these into a remote decoder routes the contents through someone else’s server logs. This decoder runs entirely in your browser using the native atob/btoa primitives. Files never upload; output never persists.

Frequently asked questions

What is the difference between Base64 and Base64url?

Standard Base64 uses +, /, and = padding. Base64url replaces + with -, / with _, and strips padding so the value fits cleanly in URLs and JWTs. Our decoder accepts both forms.

Why does my Base64 decode produce garbage?

Either the input has whitespace or quotes that need stripping, or it is Base64url being decoded as standard Base64. Try the auto-detect mode — if it still fails, paste a known-good sample to confirm the tool is healthy.

How do I encode a file as a data URL?

Drop the file onto the input pane. We compute the MIME type from the file header and produce data:<mime>;base64,<encoded> ready to drop into HTML or CSS.

What is the maximum file size?

Encoding runs in chunks via FileReader — files up to about 100 MB work cleanly. For larger blobs, prefer a streaming approach like base64 at the shell.

Is Base64 encryption?

No. Base64 is a text-safe encoding — anyone with the encoded value can decode it. For confidentiality, use real encryption (AES-GCM) and keep the key secret. Try the AES Encrypt / Decrypt tool.

Can I decode many lines at once?

Yes. Toggle Batch mode. The tool treats each line as an independent payload and shows a column of decoded results, ideal for processing log entries or columnar exports.

Related tools

Last updated: 2025-01-15