What Base64 is for
Base64 represents arbitrary bytes using 64 printable ASCII characters (A–Z, a–z, 0–9, + and /), so binary data can travel through systems that only handle text: email attachments (MIME), data: URLs, JSON fields, HTTP Basic authentication headers and the parts of a JSON Web Token. Every 3 input bytes become 4 output characters, so encoded data is about 33% larger. Base64 is an encoding, not encryption: anyone can decode it.
The URL-safe variant (base64url, RFC 4648 §5) swaps + and / for - and _ and usually drops the trailing = padding, so the result can sit in URLs and filenames without escaping. JWTs use it.
Worked example
foobar is the bytes 66 6F 6F 62 61 72. Grouped into 6-bit chunks they map to Zm9vYmFy. ção is 5 UTF-8 bytes (C3 A7 C3 A3 6F) and encodes to w6fDo28=; the = pads the last group to 4 characters.
How this works
Text is first encoded to UTF-8 bytes with the browser's TextEncoder, then each 3-byte group is split into four 6-bit values that index the alphabet (RFC 4648 §4). Decoding reverses this: whitespace is ignored, the URL-safe characters are mapped back, missing padding is restored, and the bytes are decoded as strict UTF-8 so invalid sequences are reported instead of silently replaced.
Frequently asked
Is Base64 encryption?
No. It is a reversible encoding with no key. Never use it to hide passwords or secrets.
Why does my decoded text look garbled?
The bytes were probably not UTF-8 text (for example an image or a file in another encoding). This tool reports invalid UTF-8 instead of showing replacement characters.
What is the difference between Base64 and base64url?
base64url replaces + with - and / with _, and usually omits = padding, so it is safe in URLs. Both are defined in RFC 4648.
Is anything uploaded?
No. Encoding and decoding happen in this tab; the text is never sent, stored or logged.
Sources
Reviewed Oct 17, 2026 · test vectors fixtures/dev/base64-encode/