Encode and Decode Base64 Instantly with the Base64 Encoder

APIs, JWTs, data URIs, and email MIME all speak Base64. You paste a string, need the encoded form for a header, or receive a blob that looks like noise until you decode it. The Base64 Encoder turns that round trip into a live, in-browser conversion: type or paste on one side and the other updates immediately.

This guide covers what Base64 actually is, why btoa() in a browser is not enough for Thai or emoji, when to switch on URL-safe mode, and how the decoder repairs padding and whitespace so real-world strings still decode. Nothing is uploaded. Tokens, API keys, and private notes stay on your device.

Whether you are stuffing a JSON field, putting a token in a query string, or checking what a data: URI contains, the same two modes cover encode and decode.

Why Use the Base64 Encoder?

• UTF-8 is the default, not an afterthought. TextEncoder and TextDecoder handle Thai, CJK, emoji, and combining marks. Classic btoa('สวัสดี') throws; this tool does not.
• URL-safe mode for links and filenames. Toggle it to swap +// for -/_ and strip padding so the result can sit in a query parameter without extra escaping.
• Live conversion. There is no Encode button to miss. The result updates as you type, with a character count on both panes.
• Forgiving decode. Whitespace and missing = padding are normalized. URL-safe input decodes even if you forgot to switch modes.
• Swap to reverse the trip. One click moves the output into the input and flips encode/decode so you can verify a round trip.
• Private by design. Encoding runs in the tab. Secrets used as examples never hit a server.

Key Features

• Encode uses TextEncoder then btoa on the raw bytes, so a string that contains non-Latin-1 characters still produces valid Base64.
• Decode accepts standard and URL-safe alphabets, strips interior whitespace, and re-pads to a multiple of four characters before atob.
• Invalid length (a remainder of 1 after padding rules) or corrupt alphabet characters surface as a clear error instead of a silent empty box.

How to Use

1. Open the Base64 Encoder and leave Mode on Encode (the default).
2. Paste or type the plaintext. The Base64 result appears on the right as you type. Copy it when you need it in a config file or request body.
3. Need a string that can live in a URL? Turn on URL-safe Base64. The alphabet changes to - and _ and padding is removed.
4. To decode, switch Mode to Decode, paste the Base64 (standard or URL-safe, with or without padding), and read the restored text. Use Swap if you just encoded and want to confirm the reverse.
5. Copy the output, or Clear the input to start over. Character counts help you spot truncated pastes.

Understanding Base64

Base64 maps every 3 bytes of input (24 bits) onto 4 characters from a 64-symbol alphabet. Each character represents 6 bits. If the input length is not a multiple of 3, the encoder pads with = so the output length stays a multiple of 4. That is why a short string like Hi becomes SGk= — the equals signs are padding, not data.

Standard Base64 uses A–Z, a–z, 0–9, +, and /. Those last two characters are reserved in URLs: + can be treated as a space in query strings, and / is a path separator. URL-safe Base64 (RFC 4648 §5) substitutes - and _ and often omits padding. JWT payloads, some OAuth tokens, and filename-safe blobs use this variant. This tool's decode path accepts both alphabets, so you do not have to remember which flavor you were handed.

Encoding is not encryption. Anyone can decode Base64. Use it to make binary-safe text, not to hide a password. For actual hashing, use a dedicated hash tool; for reversible secrets you still need a real cipher and a key you do not paste into a public form.

A common JavaScript pitfall: btoa() and atob() operate on Latin-1 bytes, not Unicode code points. Passing a string with a character above U+00FF throws. The correct pattern is encode to UTF-8 bytes first, then Base64 those bytes — which is exactly what this encoder does. Decoding reverses it with TextDecoder, so a Thai sentence round-trips without mojibake.

Whitespace inside a Base64 blob is technically invalid, but email and logs wrap lines at 76 characters (MIME). The decoder strips whitespace before parsing so a wrapped paste still works.

Practical Use Cases

JSON and HTTP payloads

APIs often expect a small binary field as a Base64 string inside JSON. Encode the raw value locally, paste it into the body, and send. When a webhook returns a Base64 field, decode it here before writing a parser. Because conversion is live, you can tweak the source and watch the encoded length change — useful when a gateway enforces a size limit.

Tokens in query strings

A standard Base64 string in a ?token= parameter will break on + and /. Enable URL-safe mode, copy the result, and drop it into the URL. On the way back, paste whatever the server sent; the decoder maps -/_ back to +// and restores padding.

Checking data URIs and config snippets

A data:text/plain;base64,... URI is just a media type plus a Base64 payload. Copy the payload after the comma, switch to Decode, and read the original text. The same workflow applies to .env samples, Kubernetes secrets that are Base64 (not encrypted), and CI variables you want to inspect without installing base64 on a laptop.

Unicode content and i18n fixtures

QA teams often need a known Base64 encoding of a Thai or mixed-script string to assert that an API preserved UTF-8. Encode the fixture here, commit the expected string, and you avoid the btoa trap that only appeared in a Latin-1 test suite.

Best Practices

• Do not treat Base64 as a secret. It is an encoding. Assume anyone who sees the string can recover the original.
• Prefer URL-safe when the string leaves a JSON body. Query strings, path segments, and filenames are the usual breakage points for + and /.
• Keep padding in storage, drop it in URLs. Databases and MIME expect =; many URL schemes do not. Decode here either way.
• Round-trip once. Encode, Swap, and confirm the text matches. That catches a truncated copy or a stray newline.
• Watch character counts. A decode that is far shorter than you expected usually means the paste was cut off or still wrapped in quotes.
• Stay in the browser for secrets you should not upload. This tool never sends the buffer; that is the point of a client-side encoder.

Need to encode a string now? Open the Base64 Encoder, paste the text, and copy the result. URL-safe mode is one toggle away when the destination is a link rather than a JSON field.

Related Tools You Might Like:

• URL Encoder — percent-encode reserved characters for query strings and paths.
• Hash Generator — SHA and MD5 hashes when you need integrity, not reversible encoding.
• Image to Base64 Converter — turn an image file into a data URI or Base64 string.

Happy encoding!