Encode/Decode Base64 is a free online tool that encodes plain text to Base64 format or decodes Base64 back to readable text. Base64 is one of the most common encodings in web development, and understanding what it actually does — and doesn't do — matters for using it correctly.
Base64 is a binary-to-text encoding scheme: it takes arbitrary bytes and represents them using only 64 printable ASCII characters (A-Z, a-z, 0-9, plus + and /), which makes the result safe to embed anywhere that expects plain text — a JSON field, an XML document, an HTTP header, or a URL — without worrying about unprintable control characters or encoding mismatches corrupting the data in transit. It works by regrouping input bytes into 6-bit chunks (since 2^6 = 64) instead of the usual 8-bit bytes, then mapping each 6-bit value to one of the 64 allowed characters; because 3 bytes (24 bits) divide evenly into four 6-bit groups, Base64 output is always a multiple of 4 characters, padded with = when the input isn't a clean multiple of 3 bytes.
You'll run into Base64 constantly in real systems: a data URI like data:image/png;base64,iVBORw0KG... embeds an entire image directly inside HTML or CSS with no separate file request; the header.payload.signature structure of a JWT has its first two segments Base64URL-encoded JSON, which is why anyone can read (though not forge) a JWT's claims without a library; HTTP Basic Authentication sends credentials as Authorization: Basic <base64 of user:pass>; and email systems have used Base64 (specifically the MIME standard) since the 1990s to safely transmit binary attachments over protocols originally designed only for 7-bit ASCII text.
The single most important thing to understand about Base64 is that it is encoding, not encryption. There is no secret key involved, and no cryptographic transformation happens — any Base64 string can be decoded back to its original bytes instantly by anyone, with no password required. Seeing Base64 in a config file, a cookie, or a URL parameter should never be read as a security measure; it's purely a format-compatibility trick for making binary or special-character data safe to transport as plain text.
Everything here processes as plain UTF-8 text. This tool correctly round-trips Unicode characters — accented letters, CJK text, emoji — by percent-encoding them before the browser's native btoa() call and reversing that with decodeURIComponent after atob(), since btoa() alone only supports the Latin-1 character range and throws on anything outside it. All processing happens locally in your browser tab; nothing you type is ever transmitted to a server.
Encoding a whole image file instead of text? Encode Image to Base64 is built for that, and Verify & Decode JWT reads the Base64-encoded segments inside a token.
