Base64 Encode / Decode (Text)

Base64 for Text, Done Correctly

Base64 turns any data into a string built from 64 safe characters — letters, digits, +, / and the = padding sign. That alphabet survives places where raw text breaks: HTTP headers, URLs (in its URL-safe variant), XML documents, configuration values and protocols designed decades ago for plain ASCII. This tool encodes text to Base64 and decodes Base64 back to text, in both directions handling the detail many online converters fumble: real Unicode. Emoji, Turkish, Arabic, Chinese — everything encodes and decodes correctly here because the tool converts text through proper UTF-8 bytes rather than assuming the Latin alphabet.

How to Use It

1. Choose direction with the tabs: Encode or Decode.
2. Paste your input. The output appears instantly as you type.
3. For decoding, whitespace and line breaks in pasted strings are cleaned automatically, and both standard (+/) and URL-safe (-_) alphabets are accepted.
4. Copy the result with one click, or swap output back to input to verify a round trip.

Where Text Base64 Shows Up in Real Work

• HTTP Basic authentication: the Authorization header carries user:password Base64-encoded — decoding one is often the fastest way to check what credentials a request actually sent.
• JWT tokens: their header and payload are Base64URL-encoded JSON; decoding reveals the claims (the JWT Decoder on this site automates the full job).
• Email internals: MIME encodes subject lines and bodies in Base64 when they contain non-ASCII characters.
• Configuration and secrets: Kubernetes secrets, environment variables and many config formats store values Base64-encoded to survive any character.
• Data URIs and APIs: textual payloads embedded where only “safe” strings are allowed.

The Critical Thing Base64 Is Not

Base64 is encoding, not encryption — a reversible representation, not a secret. Anyone can decode it instantly, with this page or one line of code. Treating Base64 as protection is a real and recurring security mistake: credentials “hidden” in Base64 are plaintext to any attacker. Use it to make data transportable; use actual cryptography to make data confidential. The fact that this tool decodes anything you paste in milliseconds is itself the demonstration.

Technical Notes for Correct Results

Encoding here is UTF-8 first, then Base64, which is the modern convention — if a legacy system disagrees about the text encoding, the decoded bytes differ, and that mismatch (not Base64 itself) is the usual cause of mojibake from old systems. The decoder tolerates missing padding (=) because URL-safe usage often strips it, and reports clearly when input contains characters outside both Base64 alphabets instead of guessing. Round trips are lossless: encode, decode, and you have your exact original, byte for byte. Everything runs locally in the page — paste tokens, secrets and internal data without them ever leaving your machine.

A Sixty-Second Exercise

If Base64 is new to you, run this experiment: type your name, copy the encoded output, then decode it back. Notice the output length is about a third longer, that the result often ends with one or two equals signs (padding to a multiple of four characters), and that encoding the same input always produces the same output — Base64 is deterministic, with no randomness and no secret involved. Sixty seconds of play here builds the mental model that makes every Base64 string you meet in headers, tokens and configs instantly legible.