Base64 decode and encode

Base64 writes any bytes using 64 safe characters, so binary data can travel through systems built for text: email, JSON, HTML, HTTP headers. It takes the input 3 bytes (24 bits) at a time and splits them into four 6-bit numbers. Each number from 0 to 63 picks one character from the alphabet.

Example: the text Man is the bytes 4D 61 6E, or the bits 010011 010110 000101 101110. Those are 19, 22, 5 and 46, which are T W F u, so Man encodes to TWFu. With one byte left over at the end you get two characters and ==; with two, three characters and =.

The output is always about a third larger than the input. Base64 is not compression and not encryption: it is fully reversible by anyone.

Standard Base64 uses + and /, which mean something in URLs (+ becomes a space in a query string, / splits the path). RFC 4648 section 5 defines a URL- and filename-safe alphabet that swaps just those two characters.

The decoder above accepts both alphabets and missing padding, so you can paste the middle part of a JWT straight in. To read a whole token with its expiry times, use the JWT decoder.

Browser JavaScript. btoa() and atob() work on strings where each character is one byte, so text with emoji or accents needs a trip through UTF-8 bytes first:

// Text → Base64 (UTF-8 safe)
const bytes = new TextEncoder().encode('Grüße 👋');
const b64 = btoa(String.fromCharCode(...bytes)); // fine for small inputs

// Base64 → text
const back = new TextDecoder().decode(Uint8Array.from(atob(b64), c => c.charCodeAt(0)));

// Newer browsers (Baseline 2025): built-in, with Base64URL and padding options
new TextEncoder().encode('hi').toBase64({ alphabet: 'base64url', omitPadding: true });
Uint8Array.fromBase64('aGk=');

Node.js

Buffer.from('Grüße 👋').toString('base64');          // encode
Buffer.from('R3LDvMOfZSDwn5GL', 'base64').toString(); // decode
Buffer.from(data).toString('base64url');                // URL-safe, no padding

Python

import base64
base64.b64encode('Grüße 👋'.encode()).decode()     # 'R3LDvMOfZSDwn5GL'
base64.b64decode('R3LDvMOfZSDwn5GL').decode()      # 'Grüße 👋'
base64.urlsafe_b64encode(b'\xfb\xff')               # b'-_8='

Go

s := base64.StdEncoding.EncodeToString([]byte("hello"))   // aGVsbG8=
b, err := base64.StdEncoding.DecodeString(s)
jwtPart := base64.RawURLEncoding.EncodeToString(b)          // URL-safe, no padding

Terminal

echo -n 'hello' | base64            # aGVsbG8=   (-n: no trailing newline)
echo 'aGVsbG8=' | base64 -d          # hello
base64 -w 0 file.bin > file.b64      # GNU: one line (default wraps at 76)
base64 -i file.bin -o file.b64       # macOS

• HTTP Basic auth: Authorization: Basic dXNlcjpwYXNz is just user:pass in Base64 (RFC 7617). Decoding it shows the password, which is why Basic auth needs HTTPS.
• Data URIs: data:image/png;base64,iVBORw0KGgo… puts a whole file inside HTML or CSS. Convert pictures with the image to Base64 converter.
• JWTs: the header and payload are Base64URL-encoded JSON. Decode either part here and tick Format JSON.
• Email attachments: MIME encodes attachments in Base64 with lines of at most 76 characters (RFC 2045). Choose 76 under Line length to match.
• PEM keys and certificates: the text between -----BEGIN …----- lines is Base64 of DER bytes, wrapped at 64 characters (RFC 7468).
• Kubernetes Secrets: values under data: are Base64-encoded, not encrypted. Decode one here to check it, and use a hash when you need a one-way fingerprint instead.

Looking for more than a free tool? Browse security tools on DevHunt or API tools.