Base64 Converter

About this base64 converter

Base64 is a way of representing arbitrary binary data as plain ASCII text. It uses a fixed alphabet of 64 printable characters — A–Z (26), a–z (26), 0–9 (10), plus the symbols + and / (2) — to encode every 6 bits of source data. When the source length is not a multiple of three bytes, the output is padded with one or two = signs to keep the encoded length a multiple of four. The result is roughly 4/3 the size of the original (a 33% overhead), but it is safe to embed anywhere that only accepts text: URLs, JSON, XML, email headers, HTML data: URIs, environment variables, source-code comments.

There are two main variants of the alphabet. Standard Base64 (defined in RFC 4648 section 4) uses + and /, which causes problems when the encoded string ends up in a URL — / collides with path separators and + is interpreted as a space in query strings. Base64URL (RFC 4648 section 5) swaps + for - and / for _, and typically omits the trailing = padding so the string is safe to drop into a URL or filename without further escaping. JSON Web Tokens (JWTs), OAuth state parameters and many web APIs use Base64URL throughout. Always know which variant your downstream system expects — feeding standard Base64 into a Base64URL decoder will fail on every string that happens to contain + or /.

Common uses cover almost every part of the web stack. Data URIs embed small assets directly in CSS or HTML (e.g. background-image: url(data:image/png;base64,iVBORw0KGgo...)), which saves an HTTP request at the cost of a larger stylesheet. HTTP Basic Auth headers send credentials as Base64-encoded "username:password" — not encrypted, just encoded, which is why Basic Auth must only be used over HTTPS. JSON cannot hold raw binary, so APIs that send images, signatures or certificates over JSON encode them as Base64 strings. Email attachments and email headers with non-ASCII characters use MIME encoded-word ("=?UTF-8?B?...?=") which is Base64 under the hood. Cryptographic keys, certificates and signatures (PEM files) wrap Base64 between BEGIN/END marker lines.

Despite the encoding, Base64 is NOT encryption. It is a deterministic, public algorithm — anyone who sees the encoded string can decode it back to the original with one line of code. Treat Base64 as you would treat a translation into another alphabet, not as a form of secrecy. Real privacy needs a cryptographic primitive: AES-GCM for symmetric encryption, RSA or elliptic-curve for key exchange, modern password hashes (Argon2, scrypt, bcrypt) for credentials at rest. Base64 is often combined with these (you encode encrypted bytes as Base64 to fit them into a JSON field) but the security comes from the cipher, not from the encoding.

Performance matters at scale. Inline Base64 images in a stylesheet inflate the CSS file by ~33%, which can hurt first-paint metrics for users on slow connections — for anything above a few kilobytes (small icons, tiny inline SVGs), serving the image as a separate file usually wins. Browsers can decode Base64 quickly, but copying massive Base64 blobs through clipboards or text editors becomes painful past a few megabytes. Base64 is one of a small family of ASCII-safe encodings: Base16 (plain hex, double overhead, easy to read), Base32 (uses 32 letters and digits, used by Tor onion addresses and TOTP secrets) and Base85/Ascii85 (used in PostScript and PDFs, smaller overhead but harder to embed in URLs). Base64 is the default because the alphabet is short enough to be easy and long enough to be efficient.

How to use it

1. Pick a mode — encode (text to Base64) or decode (Base64 to text).
2. Paste your input into the source box, or drag a file in for binary encoding.
3. Click Convert (or watch the output update live as you type).
4. Copy the output to the clipboard with one click.
5. For Base64URL output, replace + with - and / with _ and strip trailing = if your target requires it.

Tips & notes

• Base64 is NOT a security tool. Anything you encode can be trivially decoded by anyone — use proper encryption (AES, RSA, libsodium) for secrets you actually need to protect.
• For URLs, prefer Base64URL (with - and _ in place of + and /) over standard Base64 to avoid percent-escaping in path components and query strings.
• For data URIs in CSS, only inline very small assets — icons under about 2 KB. Above that, the 33% encoding overhead and the loss of HTTP caching outweighs the saved request.
• For files larger than a few megabytes, server-side encoding (or a streaming encoder) will be faster and less memory-hungry than browser-based encoding.
• For HTTP Basic Auth, remember the header is Authorization: Basic <base64-of-user:pass> — never use it over plain HTTP because the credentials are recoverable instantly.
• For PEM files (certificates, keys), the body between BEGIN and END lines is already Base64 — strip the markers and line breaks before pasting into a decoder.

Frequently asked questions