Related Tools
Base64 Encode & Decode Online Free — Text, Files & Images
What's included
Features
About this tool
Base64 Encoder & Decoder — Encode Text, Files, and Images Instantly
You need to encode a string to Base64 for an Authorization header. Or you got a Base64 blob from an API response and need to read what's inside. Or you're trying to decode a JWT token's payload without installing anything. This free online Base64 encoder and decoder handles all three — paste any text or Base64 string and the output is instant, right in your browser.
Base64 is a binary-to-text encoding that converts any data into a string of 64 safe printable characters. It exists because binary data — image bytes, file bytes, arbitrary byte sequences — can't safely travel through text-only channels like JSON, email headers, HTML attributes, and HTTP headers. Those channels may corrupt or strip certain byte values. Base64 solves this by encoding every 3 input bytes into exactly 4 printable characters, so the output is safe anywhere text is allowed.
Which variant do you need? Standard Base64 is the default — used for HTTP headers, general encoding, and most APIs. Base64URL replaces + with - and / with _ and drops the = padding — this is the variant used inside JWT tokens, because + and / are special characters in URLs. MIME Base64 adds a line break every 76 characters — that's the format for email attachment encoding.
Data URIs: When encoding an image or file, enable the Data URI toggle to wrap the output in data:image/png;base64,... format. Paste that directly into an HTML <img src=""> or CSS background-image: url() and the browser renders the image without any network request — no server needed.
Important: Base64 is encoding, not encryption. Anyone can decode it in one line of code with no key. Never use it to hide passwords, API secrets, or sensitive data. For security, use proper encryption. For JWT tokens specifically, the security comes from the digital signature — not from the Base64URL encoding of the header and payload.
Everything in this tool runs 100% in your browser. Nothing is uploaded to a server. Safe for API keys, certificate data, or any content you wouldn't want sent to a third-party service.
Step by step
How to Use
- 1Choose Encode or Decode modeUse the Encode / Decode toggle at the top of the tool to select which direction you want to convert. Encode turns plain text or file bytes into a Base64 string. Decode turns a Base64 string back into readable text or an image.
- 2Select the right Base64 variantChoose Standard (RFC 4648) for most uses — HTTP headers, API payloads, and general encoding. Choose Base64URL when encoding values that will appear in URLs, JWT tokens, or filenames — it replaces
+with-and/with_and removes=padding. Choose MIME for email attachments that require a line break every 76 characters. - 3Input text, paste Base64, or upload a fileIn Encode mode, type or paste your text into the input pane — the Base64 output appears instantly on the right as you type. To encode a file or image, click File or drag and drop any file onto the input area. In Decode mode, paste a Base64 string and the decoded text appears immediately. If the decoded content is an image (PNG, JPEG, GIF, WebP, SVG), a live preview is shown above the text output.
- 4Enable Data URI for HTML and CSS use (optional)When encoding an image or file in Encode mode, toggle Data URI on. The output is wrapped in
data:mime/type;base64,...format automatically — paste it directly into an HTML<img src="">attribute or a CSSbackground-image: url()to render the image with no network request. Most useful for small icons, email templates, and offline-first apps. - 5Copy, download, or swap the outputClick Copy to copy the full output to your clipboard, or the Download icon to save it as a file. Use the ⇄ swap button to send the current output back to the input and flip modes — useful for round-trip verification (encode, then swap and decode to confirm you get the original text back). The byte counter shows input and output sizes and the size change — Base64 output is always approximately 33% larger than the input.
Real-world uses
Common Use Cases
<img src=""> attribute or a CSS background-image: url() value. The browser renders the image instantly with no network request — useful for email templates where external images are blocked, and for small icons in offline-first apps.Authorization: Basic [base64("username:password")]. Type your username:password string in Standard mode, encode it, and prepend "Basic " to the result. Use Standard (not Base64URL) — Basic Auth uses RFC 4648 Standard encoding.@font-face src declaration or background-image URL as Base64 Data URIs — eliminating the extra font file request for custom icon fonts or decorative patterns.Got questions?
Frequently Asked Questions
Select Encode mode (the toggle at the top), paste or type your text in the input panel, and the Base64 output appears instantly on the right. No button click needed — it updates live as you type. Choose Standard Base64 for most uses. If you need the output to be safe in a URL or JWT token, select Base64URL instead.
Select Decode mode, paste your Base64 string into the input panel, and the decoded text appears instantly. If the Base64 string is from a JWT token, select the Base64URL variant — JWT uses Base64URL (with - and _ instead of + and /) rather than Standard Base64. If the decoded result is an image, a live preview is shown below the text output.
No — Base64 is encoding, not encryption. It is completely reversible with no key or password. Anyone can decode a Base64 string in one line of code in milliseconds. The scrambled-looking output is not security — it is just a different text representation of the same data. Never Base64-encode passwords, API secrets, or sensitive data to "hide" them. Use proper encryption (AES-256) or hashing with salts (bcrypt, Argon2) for real security.
A JWT has three parts separated by dots: header.payload.signature. The header and payload are each Base64URL-encoded JSON objects. Select Base64URL variant and Decode mode, then paste the second segment (the payload — between the first and second dots) to read the JSON claims: user ID, role, expiry (exp), issuer (iss), and audience (aud). Note: decoding the payload does not verify the signature — it only reads the claims. The security of a JWT comes from the digital signature, not the encoding.
Standard Base64 uses + and / as the 63rd and 64th characters and adds = padding. These are problematic in URLs: + means space in form-encoded query strings, / is a path separator. Base64URL replaces + with - and / with _ and drops the = padding, making the output safe in URLs, query parameters, and file names. JWT tokens use Base64URL because the token appears in HTTP headers, query parameters, and cookies where + and / would cause parsing issues.
Upload your image file (or drag and drop it onto the input panel), then enable the Data URI toggle. The output will be wrapped in the format data:image/png;base64,... automatically. Paste that entire string into an HTML <img src=""> attribute or a CSS background-image: url() and the browser renders the image without making any network request. This is most useful for small icons, email template images where external URLs are blocked, and offline-first applications.
Base64 uses 4 characters to encode every 3 bytes of input — a 33% size increase. A 100 KB image becomes roughly 133 KB as Base64. For small files (a few KB), this overhead is often worth it to eliminate an extra HTTP request. For larger files, serving them as separate files with proper compression is almost always more efficient than embedding them as Data URIs.
Base64 encodes in 3-byte blocks, producing 4 output characters per block. When the input length is not a multiple of 3, the last block is padded with = characters to complete the group — one = if the last block had 2 bytes, two == if it had 1 byte. Base64URL omits this padding since the decoder can infer it from the string length. This is why JWT token segments have no = signs.
Yes — 100% private. All encoding and decoding runs in your browser using native JavaScript: btoa(), atob(), TextEncoder, TextDecoder, and the FileReader API. Nothing is uploaded to a server. You can safely encode API keys, certificate data, tokens, private user data, and any binary content you would not want sent to a third-party service. The tool also works fully offline once the page has loaded.