Rankato

Free Base64 Encoder & Decoder

Encode text or files to Base64. Decode Base64 back to text or download the original bytes. Standard + URL-safe variants, MIME wrap, and UTF-8 support — all in your browser.

Plain text
Base64
0 chars · 0 BStandard
Your Base64 will appear here.
0 charsno wrap

Encoded in your browser · nothing is uploaded

The Base64 Encoder/Decoder converts text and files to and from Base64, a text-safe encoding used everywhere from HTTP Basic auth headers to data URIs, JWT payloads, PEM certificates, email attachments, and OAuth callback state. Paste text to encode it, paste Base64 to decode it, or upload a binary file (image, PDF, key file) and get a copy-ready Base64 string. Supports the standard alphabet and the URL-safe variant (RFC 4648 §5, with -/_ instead of +//), optional MIME line wrapping (64 or 76 characters), padding toggle, and both UTF-8 and Latin-1 character sets. Everything runs in your browser — nothing is uploaded.

What is Base64 and when do you use it?

Base64 is a text-safe encoding that represents arbitrary bytes using only 64 printable ASCII characters: A–Z, a–z, 0–9, and two symbols (+ and / for standard, - and _ for URL-safe). It exists so binary data — images, PDFs, encryption keys, protocol buffers — can travel through channels that only accept text: HTTP headers, JSON payloads, XML documents, email bodies, URLs, and cookies. You encounter Base64 in HTTP Basic auth (Authorization: Basic dXNlcjpwYXNz), in JWTs (three Base64URL segments separated by dots), in data URIs (data:image/png;base64,…), in PEM-encoded certificates, and in MIME email attachments. The trade-off: Base64 is ~33% larger than the original bytes, so it's used for transport safety, not for compression.

Standard Base64 vs. URL-safe Base64

There are two common alphabets. Standard Base64 (RFC 4648 §4) uses + and /. Those characters are unsafe in URLs (+ means a space in a query string, / is a path separator) and inconvenient in filenames. URL-safe Base64 (RFC 4648 §5) swaps them for - and _, which are safe in URLs and filenames without escaping. JWTs use URL-safe Base64 without padding. If you're encoding for a URL, cookie value, filename, or JWT payload, choose URL-safe. If you're producing a PEM block or a MIME attachment, choose standard. The decoder in this tool accepts both — it normalises -/_ back to +// before decoding.

Padding, line wrap, and MIME

Base64 encodes 3 bytes at a time into 4 characters. If the input length isn't a multiple of 3, the output is padded with = so its length is a multiple of 4: one = for two remaining bytes, two =s for one remaining byte. Padding makes decoders simpler because they can rely on a fixed alignment. Some contexts — URLs, JWTs, and any transport where = is inconvenient — drop the padding, and decoders must add it back mathematically. This tool lets you toggle padding on or off for the encoded output. MIME line wrapping (RFC 2045) requires that Base64 lines be at most 76 characters long, separated by CRLF. Older PEM formats use 64. Set the wrap length in the settings panel; for URL contexts, keep it off (one long line).

UTF-8, Latin-1, and how text becomes bytes

Base64 doesn't operate on text — it operates on bytes. So before encoding text, we have to decide how to turn characters into bytes. The default here is UTF-8, the encoding used by ~98% of the web: it represents ASCII as one byte, and non-ASCII characters (accents, emoji, CJK) as two-to-four bytes. This is almost always what you want. Latin-1 (ISO-8859-1) is a legacy 8-bit encoding where every character is exactly one byte; it's only correct for text that contains no characters above U+00FF. Old JavaScript code sometimes uses Latin-1 implicitly (that's what the built-in btoa() does — which is why btoa('café') throws). This tool uses TextEncoder/TextDecoder to do UTF-8 correctly, so emojis and accented characters round-trip cleanly.

Encoding and decoding files

Click the upload icon to encode a binary file (image, PDF, key file, anything). The tool reads the raw bytes with FileReader.readAsArrayBuffer and produces a Base64 string you can paste into a data URI, an API request body, or a config file. In decode mode, upload works too — but it expects the file to contain Base64 text, and it will decode the bytes back into the output pane, ready to download as a binary file. Everything happens in your browser: the file is never sent to any server, which matters for private keys, unreleased assets, or medical images. For very large files (tens of MB) the browser tab may briefly become unresponsive while encoding — Base64 is CPU-cheap but the resulting strings are ~4/3 the size of the input.

Tool FAQs

Everything you need to know about using Base64 Encoder / Decoder.

Is Base64 encryption? Does it hide my data?+

No. Base64 is an encoding, not encryption. Anyone with the encoded string can decode it back to the original bytes in one function call — there's no key, no secret, no protection. Base64 exists to make binary data safe to transport as text, not to hide it. If you need to protect data, use encryption (AES, RSA, libsodium); if you just need a compact identifier that's hard to guess, use a random UUID or a signed token like a JWT.

Why does Base64 make my data bigger?+

Base64 uses 4 output characters to represent every 3 input bytes, so the encoded string is roughly 33% larger than the original — plus a few more characters for padding and (if enabled) line breaks. A 1 MB file becomes ~1.37 MB of Base64. That overhead is the cost of squeezing binary data through text-only channels. If size matters (embedding assets in a bundle, sending over a slow connection), consider whether you really need Base64 at all — many APIs accept multipart/form-data uploads that pass raw bytes without the 33% penalty.

What's the difference between standard and URL-safe Base64?+

Two characters differ. Standard Base64 (RFC 4648 §4) uses + and /. URL-safe Base64 (RFC 4648 §5) uses - and _ so the output is safe to drop into a URL, a filename, or a cookie value without percent-encoding. URL-safe Base64 also usually omits the trailing = padding. JWTs, OAuth state parameters, and modern web tokens use URL-safe Base64. PEM-encoded certificates and MIME email attachments use standard. The decoder here accepts either; it converts -/_ back to +// and adds missing padding automatically.

Why does my decoded output show as "Binary"?+

Base64 decodes to bytes. If those bytes happen to be valid UTF-8 text (like Hello, world or {"user":"alice"}), the tool shows the text. If they aren't — e.g., you decoded a PNG, an encrypted blob, or a compressed archive — the bytes don't form a valid UTF-8 string, and the tool flags the output as Binary. You can still see a rough text preview (with replacement characters for invalid sequences), but the correct action is to click Download: the original bytes will be saved as a file you can inspect with the right tool (image viewer, hex editor, archive extractor).

Can I decode a data URI directly?+

A data URI looks like data:image/png;base64,iVBORw0KGgo…. Only the part after the comma is Base64. Strip the data:mime/type;base64, prefix and paste the rest into the input pane, then hit decode and download to recover the original file. This tool doesn't parse the prefix for you automatically because data URIs are used for many mime types and we don't want to guess extensions — but stripping the prefix is a one-second copy/paste.

Why do JWT tokens use Base64 without padding?+

JWTs are three URL-safe Base64 segments joined by dots: header.payload.signature. Padding characters (=) are stripped because the dot already unambiguously separates segments and every extra character wastes bytes in a token that often lives in a URL or a header. Decoders reconstruct the padding by rounding each segment's length up to the next multiple of 4 before decoding. This tool's decoder does exactly that, so you can paste a raw JWT segment (without padding) and it will decode cleanly.

Does this tool send my data to a server?+

No. All encoding and decoding runs entirely in your browser using the built-in TextEncoder, TextDecoder, btoa, atob, and FileReader APIs. Open your browser's Network tab and confirm zero requests fire while you paste, type, or upload. That makes it safe to encode private keys, unreleased assets, medical images, or any data you'd rather not send to a random online tool.