Base64 Encode & Decode

About the Base64 Encode & Decode

The Base64 Encode & Decode tool converts between plain text and Base64 encoding, with full UTF-8 support so non-ASCII characters (emoji, accented letters, CJK) are handled correctly. Base64 is the standard way to represent binary data as ASCII text — it appears in email attachments (MIME), data URLs, JWTs, basic auth headers, and many configuration formats that cannot safely contain raw binary.

Base64 encodes every 3 bytes of input as 4 ASCII characters from a 64-character alphabet (A-Z, a-z, 0-9, +, /). The output is roughly 33% larger than the input: a 30-byte string becomes 40 bytes of Base64. The padding character (=) is appended to bring the output length to a multiple of 4.

The tool handles the classic JavaScript gotcha where btoa() and atob() only work with Latin-1 characters (code points 0-255). For UTF-8 text, you must first encode to bytes, then convert those bytes to a Latin-1 string, then call btoa(). The tool does this automatically using the unescape(encodeURIComponent(...)) trick on encode and the reverse on decode.

How It Works

Encoding: The input string is first converted from JavaScript's UTF-16 internal representation to a UTF-8 byte sequence using encodeURIComponent(t), which produces percent-encoded ASCII. unescape() then converts those percent-encoded bytes back to a Latin-1 string (where each character is a byte value 0-255). Finally, btoa() applies the Base64 algorithm to produce the ASCII output.

Decoding: The reverse process. atob() converts Base64 back to a Latin-1 string. escape() percent-encodes any non-ASCII byte values. decodeURIComponent() interprets the percent-encoded sequence as UTF-8 and produces the original Unicode string.

The Base64 alphabet is A-Z a-z 0-9 + / with = padding. A URL-safe variant replaces + with - and / with _ (and often drops the padding) so the encoded string can be safely used in URLs without additional escaping. If you are decoding a URL-safe Base64 string, replace - with + and _ with / first.

Worked Examples

Encoding “Hello, World!” produces “SGVsbG8sIFdvcmxkIQ==”. Note the two trailing equals signs: the input is 13 bytes (not a multiple of 3), so the encoder pads the output to 20 characters (a multiple of 4). Each pair of input bytes becomes 3 Base64 characters plus one padding character.

Encoding UTF-8 text like “café” (5 characters, 6 UTF-8 bytes because é is 2 bytes) produces “Y2Fmw6k=”. Without UTF-8 handling (using btoa() directly), the é would either throw an error or produce a wrong result. The tool handles this correctly because of the encodeURIComponent trick.

For decoding, paste a Base64 string (with or without newlines, the tool trims whitespace). If you paste a URL-safe variant like “Y2Fmw6k” (no padding, using _), you may need to convert it to standard Base64 first. JWTs use URL-safe Base64 — when decoding a JWT, replace - with + and _ with / before passing to this tool.

When to Use This Tool

• Encoding credentials for HTTP Basic Auth headers (Authorization: Basic base64(user:pass)).
• Decoding JWT payload and header segments (after replacing URL-safe characters).
• Embedding small images or fonts in HTML/CSS as data URLs.
• Inspecting email attachment content (MIME parts are Base64-encoded).
• Decoding query parameters or cookies that were Base64-encoded for transport.
• Inspecting binary data embedded in JSON or XML configuration files.
• Converting between standard Base64 and URL-safe Base64 variants.

Limitations & Disclaimer

Base64 is encoding, not encryption — anyone can decode it. Never use Base64 to protect secrets; use proper encryption (AES, ChaCha20-Poly1305) instead. The tool uses the deprecated escape/unescape functions for UTF-8 handling, which work in all current browsers but may be removed in future JavaScript versions. URL-safe Base64 variants require manual character replacement before decoding. The tool does not handle Base64 streams (where padding appears mid-stream) or Base64 with embedded whitespace beyond simple newline trimming. See our disclaimer for full terms.

Frequently Asked Questions

Last updated: July 21, 2026  ·  Author: HT99 Tools Editorial Team  ·  Reviewed by: HT99 Tools Editorial Team