Base64 encoder and decoder

What Base64 does

Many systems were built to carry text, not arbitrary bytes: email, JSON, URLs, HTML attributes. Base64 turns any bytes into a string of 64 safe characters, the letters A to Z and a to z, the digits, and two symbols, so a picture, a key or a binary file can travel through them unharmed. Every 3 bytes become 4 characters, which is why encoded data is a third larger than the original.

Base64 is not encryption

Anyone can decode Base64 instantly, as this page shows; it hides nothing. It is common to find passwords, API keys and personal data "protected" by Base64 in configuration files and web pages, and they are as readable as plain text to anyone who looks. To actually protect text with a password, use encrypt text, which uses AES. To check that a file has not changed, use the hash generator.

The encoding options

• URL-safe alphabet uses - and _ instead of + and /, which have special meanings in web addresses and file names. JSON Web Tokens use it.
• Padding adds = signs so the length is a multiple of 4. Most decoders need it; URL-safe uses often leave it out.
• Line length of 64 matches PEM files such as certificates and keys; 76 matches email attachments (MIME). One line is right for everything else.
• Data URL prefix, for files, adds data:image/png;base64, or the right type in front, so the result can be pasted straight into HTML or CSS as an embedded picture or font.

Decoding accepts every variant automatically: standard or URL-safe, padded or not, with line breaks or a data URL prefix.

When embedding files makes sense

A small icon or font embedded as a data URL saves the browser one request, which can help for a handful of tiny files. For anything larger than a few kilobytes it does the opposite: the page grows by a third of the file's size, the file cannot be cached separately, and it cannot load in parallel. Keep larger pictures as normal files, compressed with compress image.

If something goes wrong

• Decoded text looks garbled. The data was a file, not text, or text in an old encoding such as Windows-1252. Decode it as a file instead.
• It says the input is not valid Base64. Characters outside the alphabet slipped in, such as spaces in the middle or a missing part. Copy the whole value again.
• A JWT decodes into nonsense. A token has three parts separated by dots; decode them with the JWT decoder.