Base64 Tools
4 free tools · 100% client-side
Convert JSON, XML, and YAML to and from Base64 with a single click — fully client-side.
Start here
Most-used Base64 Tools
Base64 Encode Decode
Round-trip any text through Base64 — emoji and all — with a URL-safe mode for tokens and strict validation that catches corrupted input.
Base64 to JSON
Decode Base64 payloads straight to validated, pretty JSON — or encode JSON to Base64 for headers and env vars.
Base64 to XML
Decode Base64 payloads to validated, formatted XML — the SAML/SOAP debugging shortcut — or encode XML for transport.
All 4 Base64 Tools
Base64 to JSON
Decode Base64 payloads straight to validated, pretty JSON — or encode JSON to Base64 for headers and env vars.
Base64 to XML
Decode Base64 payloads to validated, formatted XML — the SAML/SOAP debugging shortcut — or encode XML for transport.
Base64 to YAML
The Kubernetes-secret decoder — Base64 to clean, validated YAML and back, entirely in your browser.
Base64 Encode Decode
Round-trip any text through Base64 — emoji and all — with a URL-safe mode for tokens and strict validation that catches corrupted input.
Learn more
Base64 with validation built in
Base64 turns any bytes into transport-safe text, which is why it carries JWT segments, basic-auth headers, Kubernetes secrets, data URLs, and email attachments. The general Base64 Encode/Decode handles arbitrary UTF-8 text with an optional URL-safe alphabet for token work. The format-aware tools — Base64 to JSON, Base64 to XML, Base64 to YAML — add a verification step: the decoded payload is parsed and pretty-printed, so you instantly know whether that opaque blob in a config file is the document you think it is.
Encoding direction validates too: feed the JSON variant a broken document and it tells you before producing a Base64 string that would fail downstream. Decoding accepts padded and unpadded input and both standard and URL-safe alphabets, because real-world Base64 arrives in all four combinations.
Reading the Base64 you meet in the wild
A surprising amount of debugging is decoding: the middle segment of a JWT is Base64url-encoded JSON claims; a Kubernetes secret's data values are Base64-wrapped configs; an Authorization: Basic header is user:password encoded; a data: URL embeds an entire file. Paste any of them into the matching decoder and the content appears, formatted and validated — no scripts, no server, no trace. (For JWTs specifically, the dedicated JWT Decoder labels claims and checks expiry as well.)
Help
Frequently asked questions
Everything you need to know about the Base64 Tools.
01Is Base64 encryption? Can I store secrets in it?
No — Base64 is a reversible encoding with zero secrecy; anyone can decode it instantly. It exists so binary data survives text-only channels. If a value must be confidential, encrypt it first; Base64 is only the envelope.
02Why does my Base64 fail to decode?
Three usual causes: the string was truncated (length must be a multiple of 4 after padding), it uses the URL-safe alphabet (- and _ instead of + and /) and the decoder didn't expect it, or it isn't text at all — decoding a Base64'd image as text produces noise. These tools normalize alphabets, tolerate missing padding, and validate the decoded format explicitly.
03Why is Base64 ~33% bigger than the original?
It maps every 3 bytes to 4 characters from a 64-symbol alphabet — that 4/3 ratio is the cost of using only transport-safe characters. For large payloads, compress first and Base64 the compressed bytes.
Learn the format
Guides for base64 tools
URL Encoding Explained: %20 vs +, Reserved Characters, When to Encode
What percent-encoding does, which characters are reserved, why forms use + for a space, and how encodeURIComponent, encodeURI and URLSearchParams differ.
9 min readGuide · Developer ToolsFreeFormatter Alternatives (2026): Where Its Tools Went
FreeFormatter.com has been retired and its tool pages now return 404. A verified map of where each formatter, validator, escaper and encoder moved.
6 min readGuide · Developer ToolsSHA-256 vs MD5 vs HMAC: How Hashing Works and Which One to Use
What a cryptographic hash guarantees, why MD5 and SHA-1 are broken but fine for checksums, how HMAC differs from a hash, and why passwords need Argon2.
6 min readGuide · Web & APIsWhat is Base64? Encoding Explained Without the Mystique
How Base64 works: 3 bytes become 4 characters, why the = padding exists, where it's used (JWT, data URIs, K8s secrets) — and why it's NOT encryption.
2 min readGuide · Web & APIsHow to Decode a JWT (and Why Decoding Isn't Verifying)
Decode any JWT in seconds: the three-part structure, Base64url quirks, code and no-code methods — and the critical difference between decoding and verifying.
2 min read