Base64 Tools
Base64 Encoder / Decoder
Round-trip any text through Base64 — emoji and all — with a URL-safe mode for tokens and strict validation that catches corrupted input.
In short
Base64 represents arbitrary bytes as text by mapping every 3 bytes to 4 characters from a 64-symbol alphabet, growing the data by about 33% so it survives text-only channels such as JSON, email and URLs. It is an encoding, not encryption. This tool encodes and decodes with correct UTF-8 handling, supports the URL-safe alphabet (RFC 4648), and reports invalid input.
By NaveenKumar T · Updated
Learn: URL Encoding Explained: %20 vs +, Reserved Characters, When to Encode
- Encode & decode in one tool
- Full UTF-8 (emoji-safe)
- URL-safe alphabet option
Runs entirely in your browser — nothing you paste or open here is uploaded, logged, or stored.How we handle data →
Example
Worked example
A four-line one-time-password email encoded with the standard alphabet. It carries three line breaks and a non-ASCII em dash — precisely the input a bare btoa() call throws on.
Your verification code is 482913.
It expires in 10 minutes and can be used once.
Never share this code with anyone — NV Toolkit staff
will never ask for it by phone or email.WW91ciB2ZXJpZmljYXRpb24gY29kZSBpcyA0ODI5MTMuCkl0IGV4cGlyZXMgaW4gMTAgbWludXRlcyBhbmQgY2FuIGJlIHVzZWQgb25jZS4KTmV2ZXIgc2hhcmUgdGhpcyBjb2RlIHdpdGggYW55b25lIOKAlCBOViBUb29sa2l0IHN0YWZmCndpbGwgbmV2ZXIgYXNrIGZvciBpdCBieSBwaG9uZSBvciBlbWFpbC4=The em dash is three UTF-8 bytes (E2 80 94), so this 174-character message is 176 bytes on the wire. That is why the result is a single unbroken 236-character line ending in exactly one = pad: 176 leaves a remainder of 2 when divided by 3. The three line breaks are encoded as ordinary 0x0A bytes, so decoding returns all four lines intact.
Learn more
Base64, the duct tape of data transport
Base64 maps every 3 bytes of input to 4 characters from a 64-symbol alphabet, inflating size by ~33% in exchange for surviving any text-safe channel: JSON strings, email bodies, data: URLs, environment variables, XML attributes. That trade is everywhere — JWT segments, inline images, API keys, Kubernetes secrets.
This tool does the text round-trip with correct UTF-8 handling — the classic btoa() pitfall of mangling non-ASCII characters doesn't apply here — and offers the URL-safe alphabet for token work. For format-aware variants that validate the decoded payload, see the dedicated Base64 ⇄ JSON, XML and YAML tools.
Help
Frequently asked questions
Everything you need to know about the Base64 Encode Decode.
01How do I encode or decode Base64 here?
Pick the mode (Encode or Decode), paste your text, and press Convert. Encoding handles any UTF-8 text including emoji; decoding accepts standard and URL-safe alphabets, with or without padding, and reports invalid input instead of returning garbage.
02What is URL-safe Base64 and when do I need it?
Standard Base64 uses + and /, which collide with URL syntax. The URL-safe variant (RFC 4648 §5) swaps them for - and _ and usually drops the = padding — it's what JWTs and most web tokens use. Toggle 'URL-safe' when the output will travel inside a URL, header, or filename.
03Is Base64 encryption?
Base64 is a reversible encoding anyone can decode, with zero secrecy. Its job is transport: representing arbitrary bytes using 64 printable characters so binary data survives text-only channels. If you need confidentiality, encrypt first and Base64 the ciphertext.
04Why is my decoded output garbled?
Either the input was truncated (Base64 length must be a multiple of 4 after padding) or the original bytes weren't UTF-8 text — decoding a Base64'd image as text produces noise by definition. This tool validates UTF-8 strictly and tells you when the payload isn't text.
Keep working
Related tools
Base64 to JSON
Base64 Tools
Base64 to XML
Base64 Tools
URL Encode / Decode
Percent-encoding both ways — make any text safe in a URL, or turn %20-soup back into readable text.
JWT Decoder
Paste a token, read it like a human: decoded header and payload, annotated claims with local timestamps, expiry at a glance — plus optional signature verification.
Hash Generator
Every common digest at once — type text or drop a file and read MD5 through SHA-512 side by side, with HMAC mode and one-paste checksum verification.
SHA-256 Hash Generator
Just SHA-256, done properly: hex or Base64 output, HMAC-SHA256 for webhook signatures, and file checksums — nothing leaves your browser.
Learn the format
Related guides
URL Encoding Explained: %20 vs +, Reserved Characters, When to Encode
What percent-encoding does, which characters are reserved, why forms use + for a space, and how encodeURIComponent, encodeURI and URLSearchParams differ.
9 min readGuide · Developer ToolsSHA-256 vs MD5 vs HMAC: How Hashing Works and Which One to Use
What a cryptographic hash guarantees, why MD5 and SHA-1 are broken but fine for checksums, how HMAC differs from a hash, and why passwords need Argon2.
6 min readGuide · Web & APIsWhat is Base64? Encoding Explained Without the Mystique
How Base64 works: 3 bytes become 4 characters, why the = padding exists, where it's used (JWT, data URIs, K8s secrets) — and why it's NOT encryption.
2 min read