How to use it
- Paste or type your text into the input panel — or drag a file onto it.
- Choose Encode or Decode. The result appears as you type; there is no button to press.
- Copy the output with the Copy button, or download it as a file.
Toggle URL-safe if the result needs to travel inside a URL or a JWT, and Line wrap if you need output split into 76-character lines as email systems (MIME) expect.
What Base64 actually does
Base64 solves a specific, old problem: some channels can only carry text, but the data you want to send is arbitrary bytes. Email bodies, JSON string fields, XML documents, HTTP headers, and data URIs all fall into this category. Feed raw binary through them and bytes get mangled — a 0x00 terminates a string, a 0x0D becomes a line break, a byte above 127 gets reinterpreted under a different character set.
Base64 sidesteps this by re-expressing bytes using only 64 characters that survive almost any text channel: A–Z, a–z, 0–9, + and /. The algorithm takes three input bytes — 24 bits — and re-slices them into four 6-bit groups. Each 6-bit group has 64 possible values, so each maps to one character in the alphabet. When the input is not a multiple of three bytes, the encoder pads the final group with = so decoders know how many bytes to discard.
That mechanical detail explains the two things people notice most. Output is roughly 4/3 the size of the input, because four characters now carry what three bytes used to. And output length is always a multiple of four, because the encoder never emits a partial group.
The one thing to remember
Base64 is not a security measure. It has no key, no secret and no integrity guarantee. Anyone who sees the string can decode it in a second — including this page, offline. Base64 in a config file, an HTTP header or a cookie is obfuscation at best.
The confusion is understandable, because Base64 shows up constantly in places that are security-related. HTTP Basic authentication sends Base64(username:password) — which is why Basic auth is only safe over HTTPS. JWTs are three Base64url segments, and the first two are plainly readable by anyone holding the token. In both cases Base64 is the transport format; the security, where it exists at all, comes from something else entirely.
Common variants you will run into
URL-safe Base64 (base64url). + becomes -, / becomes _, and padding is usually omitted. Used by JWTs, and by anything that puts encoded data in a URL path or query string.
MIME Base64. Line-wrapped at 76 characters with CRLF endings, as required by email standards. Decoders generally tolerate the line breaks; some strict encoders require them.
Data URIs. data:image/png;base64,iVBORw0KG... embeds a file directly in HTML or CSS. Handy for small icons, but remember the 33% size penalty — a 40 KB image becomes about 53 KB of markup that cannot be cached separately.