Skip to content
H HT99.
Read Articles
Everyday Utilities Free · No signup · Private · Instant results

Base64 Encode & Decode

Encode text to Base64 or decode back — per RFC 4648. UTF-8 safe.

About the Base64 Encode & Decode

The Base64 Encoder & Decoder on HT99 Tools converts between plain text and the Base64 binary-to-text encoding defined in RFC 4648. Every three bytes of input become four characters drawn from a 64-symbol alphabet, which means any binary blob — an image, a DER certificate, a serialized protobuf — can be carried through a text-only channel such as JSON, XML, an HTTP header, or a cookie.

Base64 is the encoding behind HTTP Basic Auth (Authorization: Basic <base64>), email MIME attachments (RFC 2045), data URIs (data:image/png;base64,iVBORw0KG...), and the three dot-separated parts of a JWT (RFC 7515). Pick the URL-safe alphabet (RFC 4648 §5) and you also cover JWT, OpenID Connect id tokens, and most OAuth2 state parameters that ride in URLs.

The conversion is reversible and lossless, but Base64 is not encryption. It is a 1:1 transformation that anyone can undo without a key. Use it for transport and storage compatibility, never for confidentiality.

The Base64 alphabet is small enough to memorise: A–Z (0–25), a–z (26–51), 0–9 (52–61), + (62), and / (63). The URL-safe variant swaps the last two for - and _. Padding is signalled by one or two trailing = characters, which the URL-safe variant typically omits because the length is implicit in context.

How It Works

Base64 reads three input bytes (24 bits) at a time, splits them into four 6-bit groups, and maps each 6-bit value (0–63) to one character of the alphabet A–Z, a–z, 0–9, +, /. The standard alphabet is defined in RFC 4648 §3. If the input length is not a multiple of three, the output is padded with one or two = characters so the total length is a multiple of four — this lets a decoder infer the original byte count.

The URL-safe alphabet (RFC 4648 §5) swaps + for - and / for _, then drops the = padding entirely, because both +, /, and = have special meanings in URLs and would otherwise need to be percent-encoded a second time. JWT, JWS, and JWK all use the URL-safe variant without padding.

The tool handles UTF-8 correctly via the classic btoa(unescape(encodeURIComponent(str))) idiom. btoa only accepts Latin-1 code points (0–255), so multi-byte UTF-8 sequences are first expanded by encodeURIComponent into percent-encoded ASCII, then collapsed back to bytes by unescape, then encoded. The reverse on decode is decodeURIComponent(escape(atob(str))). Modern code would use TextEncoder/TextDecoder, but the legacy idiom is one short expression and works in every shipping browser.

Worked Examples

Encoding the default input Authorization: Basic dXNlcjpwYXNzMTIz with the standard alphabet produces a 40-character Base64 string QXV0aG9yaXphdGlvbjogQmFzaWMgZFhaajJ3YnBZVnNYMTIz — the byte count goes from 30 to 40, exactly a 4/3 ratio as the spec guarantees.

Decoding QXV0aG9yaXphdGlvbjogQmFzaWMgZFhaajJ3YnBZVnNYMTIz reverses the operation and yields the original 30-character string. The tool auto-restores padding if you pasted a JWT-style unpadded value.

Encoding the Unicode string café 🍽 (the coffee emoji is four UTF-8 bytes) produces a 24-character Base64 output — btoa alone would throw InvalidCharacterError on the multi-byte character, but the encodeURIComponent pre-step encodes it as UTF-8 bytes first.

When to Use This Tool

  • Encoding HTTP Basic Auth credentials into the Authorization header.
  • Producing a data URI for an inline SVG or PNG in CSS or HTML.
  • Decoding the three dot-separated segments of a JWT to inspect the header and payload.
  • Embedding a binary blob (favicon, small icon) inside a JSON config file.
  • Inspecting an OAuth2 state or id_token parameter that arrived URL-safe Base64-encoded.
  • Storing a small encrypted blob in a cookie (after encrypting with AES-GCM, not before).
  • Decoding MIME Content-Transfer-Encoding: base64 email attachment bodies.

Limitations & Disclaimer

Base64 is not encryption — it provides zero confidentiality. The tool uses the deprecated escape/unescape functions for UTF-8 handling; they remain in every browser but are flagged for removal from ECMAScript, so production code should prefer TextEncoder/TextDecoder with a manual byte walker. MIME line-wrapping (the 76-character \r\n insertion defined in RFC 2045) is not applied; use a dedicated MIME encoder if your consumer requires it. Inputs above roughly 5 MB will block the UI during the synchronous btoa/atob call. See our disclaimer for full terms.

Frequently Asked Questions

Is Base64 the same as encryption?

No. Base64 is a reversible encoding &mdash; anyone with the encoded string can decode it without a key. It provides transport compatibility, not confidentiality. Use AES-GCM, ChaCha20-Poly1305, or RSA-OAEP for actual encryption. HTTP Basic Auth over TLS is safe because TLS provides the encryption; Base64 just carries the credentials as ASCII inside the TLS tunnel.

Why does my Base64 string end with one or two = signs?

Padding. Base64 emits four characters for every three input bytes. If the input length is <code>1 mod 3</code>, two padding <code>=</code> are appended; if it is <code>2 mod 3</code>, one <code>=</code> is appended; if it is <code>0 mod 3</code>, no padding is needed. The URL-safe variant omits padding because the original length can be inferred.

When do I need the URL-safe alphabet?

Whenever the Base64 string will travel in a URL path or query parameter. The standard <code>+</code> and <code>/</code> characters are reserved in URLs (RFC 3986 §2.2) and would be percent-encoded to <code>%2B</code> and <code>%2F</code> by HTTP clients &mdash; doubling the length and confusing recipients. JWT, JWS, JWE, JWK, and most OAuth2 state values use the URL-safe variant.

Why does btoa throw on emoji and accented characters?

<code>btoa</code> only accepts code points 0&ndash;255 (Latin-1). Emoji and accented letters occupy code points above 255 and require multiple UTF-8 bytes. The fix is to first expand the string to UTF-8 bytes via <code>encodeURIComponent</code> &mdash; that is exactly what the tool does internally &mdash; or to use a <code>TextEncoder</code> and feed the resulting <code>Uint8Array</code> to a manual Base64 routine.

Can I decode a string that was encoded by Python or Node?

Yes, as long as the producer followed RFC 4648. Python's <code>base64.b64encode</code> uses the standard alphabet; <code>base64.urlsafe_b64encode</code> uses the URL-safe alphabet (without stripping padding by default). Node's <code>Buffer.from(s).toString('base64')</code> is standard; <code>.toString('base64url')</code> is URL-safe without padding. Pick the matching alphabet in this tool before decoding.

Is my data uploaded anywhere?

No. Encode and decode run entirely in your browser. Passwords, API tokens, and certificate bytes you paste here never leave the device.

Last updated: September 9, 2026  ·  Author: HT99 Tools Editorial Team