APIs and headers
Encode credentials for a test Basic auth header or a payload field.
Base64 Encode and Decode
Convert text to Base64 and back. Nothing is sent from your browser.
Your files stay with you. Your files never leave your browser. This tool runs on your device: nothing is uploaded to our servers, so there is nothing for us to store or see.
How to use it
- Type or paste your text, or the Base64 string.
- Choose Encode or Decode (and URL-safe if you need it).
- Copy or download the result.
Where it helps
Reading tokens
Decode a URL-safe Base64 part of a token to see what's inside.
Data in text
Move small bits of data through systems that only accept plain text.
Good to know
Stays in your browser
Your text is processed on your device and never sent to our servers.
Not a lock
Never use Base64 to hide passwords or secrets.
Files and images
Use the image to Base64 tool for pictures.
Questions people ask
How do you encode text to Base64 or decode Base64 back to text?
Type or paste your text or the Base64 string, choose Encode or Decode and tick URL-safe if you need it, then copy or download the result. Text is converted as UTF-8, so Hindi, Tamil, the rupee sign and emoji all work and decode back exactly. Base64 is an encoding, not encryption: anyone can decode it.
- UTF-8 Any language. ₹ and emoji too.
- URL-safe - and _. No padding.
- 2 ways Encode or decode. One switch.
- Not secret Not encryption. Anyone can decode.
Is Base64 encryption?
No. Base64 is only a way to write bytes as plain characters, so binary data can travel through text-only systems. Anyone can decode it in a second, with this tool or any other. Never use it to hide passwords, keys or private information; use real encryption for that.
Why does decoding say the data isn't text?
The Base64 may hold a file such as an image or a PDF, whose bytes aren't readable text. Decoding it as text would only show garbage. To turn an image into Base64, or to check one, use the image to Base64 tool, which handles pictures properly.
What is URL-safe Base64?
A variant that uses - and _ instead of + and /, and drops the = padding, so the result can sit in a URL or a filename without being changed. JSON Web Tokens use it. Tick the URL-safe option when encoding, and when decoding a string, though the decoder reads - and _ either way.
Does it work with Hindi or emoji?
Yes. Text is converted to UTF-8 bytes first, so any language works, including Hindi, Marathi, Tamil and Bengali, and symbols such as the rupee sign and emoji. Decoding gives back exactly the same text. Tools that skip the UTF-8 step often garble these characters. Check the decoded text once to be sure.
Why does Base64 make text longer?
Base64 uses 4 characters for every 3 bytes, so the result is about a third larger than the original. That's the price of turning any data into safe plain characters. It's why images embedded as Base64 in web pages make the page heavier. Small icons are fine; big photos aren't.
What are the = signs at the end?
They're padding. Base64 works in groups of three bytes, and when the input doesn't divide evenly, one or two = signs fill the last group. URL-safe Base64 usually drops them. The decoder here accepts strings with or without padding. Removing them doesn't change the data, only the length, so both forms decode to the same text.
How do I make a Basic auth header?
Encode username:password as Base64 and send it as 'Authorization: Basic' followed by the result. Only do this with test credentials on your own computer. Basic auth must always run over HTTPS, because the header is just encoded, not protected. Anyone who sees the header can decode it straight back to the password.
Can I decode a JWT with this?
You can decode each of the first two parts with the URL-safe option, but the JWT decoder is easier. It splits the token, decodes the header and payload as JSON and shows the expiry dates in readable form. Neither tool verifies the signature. Verify signatures on your server.
Why does decoding fail?
The string may contain characters that aren't Base64, such as quotes or a stray symbol, or it may be cut short, and the error names the problem. Spaces and line breaks are ignored, and URL-safe - and _ are read automatically, so Base64 copied from an email or a token usually decodes fine.
Where is Base64 used?
In email attachments, data URLs in web pages, API payloads that carry files, Basic auth headers, JSON Web Tokens and some configuration files, such as Kubernetes secrets. In each case it's used so binary data can travel safely as plain text. It always makes the data about a third larger.
Are Kubernetes secrets encrypted by Base64?
No. Kubernetes stores secret values as Base64, which anyone with access can decode. Protect them with access controls and encryption at rest. Avoid pasting real production secrets into any web tool, even one that runs locally like this one, on a shared machine. Use a secrets manager where possible.
Can I download the result?
Yes. Copy the result to the clipboard, or download it as result.txt. Downloading is handy for long strings, which are easy to cut short when copying by hand. The download is created in your browser, so nothing passes through a server. The file opens in any text editor.
Is my text uploaded?
No. Encoding and decoding run in your browser, and nothing is sent to our servers or saved after you close the page. That keeps test credentials and payloads private. As a habit, still avoid pasting live secrets on a shared or public computer. Nothing remains once the tab is closed.
Does it work on a phone?
Yes. Paste text or Base64 on your phone, switch between encode and decode with a tap and copy the result. It works in any modern mobile browser with no app, which is handy for checking a value from a message or email while you're away from your desk.
Is the Base64 tool free?
Yes. It's free with no sign-up and no limit on use. It's one of the free developer tools from Marketiism, along with the URL encoder, the JWT decoder and the hash generator. Marketiism builds software for small Indian businesses. Use it as often as you need, for any project.
Want this inside your own account?
Marketiism keeps your invoice numbers, GST reports, UPI payment links and WhatsApp reminders in one place. Leave your details and we'll call to set it up for your business, or start the trial yourself.
More Developer tools
URL Encode and Decode
Percent-encode or decode text for links, query strings and form data.
JWT Decoder
Read the header, payload and expiry of a JSON Web Token. Decode only, no verification.
Image to Base64
Turn an image into a Base64 data URI, an HTML img tag or CSS background code.
Hash Generator
Get MD5, SHA-1, SHA-256, SHA-384 and SHA-512 hashes of text or a file.
JSON Formatter
Format, validate and minify JSON, and see exactly which line has a mistake.
JSON to CSV
Turn a JSON list of records into CSV for Excel or Google Sheets.