Base64 Encode & Decode

Base64 encodes arbitrary bytes using only 64 printable ASCII characters (A–Z, a–z, 0–9, plus + and /, with = padding). It exists so that binary data can travel through text-only channels — email bodies, JSON fields, data URIs, HTTP headers — without being mangled. It is an encoding, not encryption: anyone can decode it, and it provides zero confidentiality. This tool works both ways at once: type text to Base64-encode it (standard and URL-safe), and paste Base64 to decode it back to text plus a hex dump of the raw bytes.

How you'll use it. Put plaintext in the first box to get its Base64 and Base64URL forms; paste an encoded string in the second box to recover the original text and inspect its bytes. The decoder accepts standard Base64 and the URL-safe variant (- and _ instead of + and /, padding optional) that appears in JWTs, JWKs, and query parameters. Everything runs locally, so it is safe for sensitive values.

Worked example. Hello, world! encodes to SGVsbG8sIHdvcmxkIQ==, and that string decodes straight back. Every four Base64 characters represent three bytes, which is why Base64 inflates size by about 33% — worth remembering before you inline a large image as a data URI.

Common mistakes. Missing or wrong padding is the usual decode failure: standard Base64 needs its length padded to a multiple of four with =. Mixing the standard and URL-safe alphabets also breaks decoding. And remember that a string decoding to gibberish may be compressed or encrypted before it was Base64-encoded — Base64 is often the outermost layer, not the only one; use the hex view to identify the inner format, and cross-check the leading bytes against known file signatures. A JWT is three Base64URL segments joined by dots — decode the first two to read the header and claims, then convert the exp with the timestamp converter.

Defensive angle. Attackers lean on Base64 constantly to slip payloads past signature-based filters — encoded PowerShell (-EncodedCommand), obfuscated webshells, exfiltrated data in DNS or HTTP. When you review logs or traffic, decode suspicious Base64 blobs and inspect what is inside rather than trusting that "it's just encoding." Values are often stacked with URL encoding or hex, so peel one layer at a time. Conversely, never rely on Base64 to hide secrets in your own apps: config values, tokens, and credentials that are "Base64-encoded" are effectively in plaintext.