Base64 Decode & Encode

What is Base64?

Base64 is an encoding scheme — not encryption — that converts binary data into a string of 64 printable ASCII characters. It uses the characters A–Z, a–z, 0–9, +, and /, with = for padding. The name "Base64" reflects the 64-symbol alphabet: each Base64 character represents exactly 6 bits (2⁶ = 64).

Base64 was developed for email systems that could only handle 7-bit ASCII text but needed to transmit binary attachments. Today it appears everywhere binary data must travel through a text-only channel: HTTP headers, JSON payloads, JWT tokens, HTML data URIs, and MIME email.

Important: Base64 is not encryption. Anyone can decode a Base64 string without a key. If you need to protect the content of a message, encrypt it first, then Base64-encode the ciphertext.

How Base64 encoding works

The encoding algorithm processes input bytes in groups of three:

1. Take 3 bytes (24 bits) of input.
2. Split into four 6-bit groups: 24 bits ÷ 6 = 4 groups.
3. Map each 6-bit value (0–63) to the Base64 alphabet — 0 = 'A', 1 = 'B', … 25 = 'Z', 26 = 'a', … 51 = 'z', 52 = '0', … 61 = '9', 62 = '+', 63 = '/'.
4. Pad with = if the input length is not divisible by 3.

Example — encoding "Man":

M  = 77  = 01001101
a  = 97  = 01100001
n  = 110 = 01101110

01001101 01100001 01101110
→ 010011  010110  000101  101110
→ 19      22      5       46
→ T       W       F       u
→ "TWFu"

Size increase: 3 input bytes always produce exactly 4 Base64 characters, so Base64 output is 4/3 × the input size — roughly 33% larger. A 1 MB file becomes approximately 1.37 MB of Base64 text (accounting for padding).

Base64 vs Base64URL — when to use each

Standard Base64 uses + and / — both of which are reserved characters in URLs. Putting a standard Base64 string in a URL query parameter without percent-encoding it will corrupt the data.

Base64URL (RFC 4648 §5) solves this by replacing:

• + → - (hyphen-minus)
• / → _ (underscore)
• = padding → omitted entirely

Use Base64URL when the encoded string will appear in a URL, filename, HTTP header, or cookie. Use standard Base64 for MIME email (RFC 2045), PEM certificates, and anywhere the = padding is expected. The decode mode of this tool accepts both — it normalizes the URL-safe characters and restores missing padding automatically.

Where you will encounter Base64URL:

• JWTs — all three parts (header, payload, signature) are Base64URL encoded without padding
• OAuth 2.0 PKCE — code verifier and code challenge
• Web Crypto API — key export and import in some formats
• URL-safe file names — derived from binary data (UUIDs, object keys)

How to encode and decode Base64 in JavaScript, Python, PHP, and Node.js

JavaScript — browser (btoa / atob)

// Encode text → Base64 (handles full UTF-8 including emoji)
function base64Encode(text) {
  const bytes  = new TextEncoder().encode(text);
  let binary   = '';
  const chunk  = 8192;
  for (let i = 0; i < bytes.length; i += chunk) {
    binary += String.fromCharCode(...bytes.subarray(i, i + chunk));
  }
  return btoa(binary);
}

// Encode text → Base64URL (no + / =)
function base64UrlEncode(text) {
  return base64Encode(text)
    .replace(/\+/g, '-').replace(/\//g, '_').replace(/=/g, '');
}

// Decode Base64 or Base64URL → text
function base64Decode(b64) {
  b64 = b64.replace(/-/g, '+').replace(/_/g, '/').replace(/\s/g, '');
  b64 += '='.repeat((4 - b64.length % 4) % 4);
  const binary = atob(b64);
  const bytes  = Uint8Array.from(binary, c => c.charCodeAt(0));
  return new TextDecoder('utf-8').decode(bytes);
}

base64Encode('Hello, World!');    // SGVsbG8sIFdvcmxkIQ==
base64Decode('SGVsbG8sIFdvcmxkIQ==');  // Hello, World!

Node.js (Buffer)

// Encode
const encoded  = Buffer.from('Hello, World!').toString('base64');
const urlSafe  = Buffer.from('Hello, World!').toString('base64url'); // Node 16+

// Decode
const decoded  = Buffer.from('SGVsbG8sIFdvcmxkIQ==', 'base64').toString('utf8');
const decoded2 = Buffer.from('SGVsbG8sIFdvcmxkIQ',  'base64url').toString('utf8');

Python

import base64

# Encode
encoded  = base64.b64encode(b'Hello, World!').decode()         # SGVsbG8sIFdvcmxkIQ==
url_safe = base64.urlsafe_b64encode(b'Hello, World!').decode() # SGVsbG8sIFdvcmxkIQ==

# Decode
decoded  = base64.b64decode('SGVsbG8sIFdvcmxkIQ==').decode('utf-8')
decoded2 = base64.urlsafe_b64decode('SGVsbG8sIFdvcmxkIQ==').decode('utf-8')

# Encode a file to Base64
with open('image.png', 'rb') as f:
    b64 = base64.b64encode(f.read()).decode()

PHP

// Encode
$encoded  = base64_encode('Hello, World!');               // SGVsbG8sIFdvcmxkIQ==
$urlSafe  = rtrim(strtr(base64_encode('Hello, World!'), '+/', '-_'), '=');

// Decode
$decoded  = base64_decode('SGVsbG8sIFdvcmxkIQ==');        // Hello, World!

// Encode a file to data URI
$data     = base64_encode(file_get_contents('image.png'));
$dataUri  = 'data:image/png;base64,' . $data;

Decoding a JWT token? Our JWT decoder parses the Base64URL-encoded header and payload for you. For binary or hex data, see the hex decoder. Making a favicon? Convert an image to a multi-size .ico with our favicon generator.

Common uses of Base64 — and when not to use it

When to use Base64:

• Data URIs in HTML/CSS — embed small images, fonts, or SVGs directly without a separate HTTP request: <img src="data:image/png;base64,…">. Best for small assets (< 2–4 KB); for larger images the 33% size overhead and loss of caching outweigh the benefit.
• HTTP Basic Auth — the Authorization: Basic header carries base64(username:password). Not encryption — always use HTTPS.
• Binary fields in JSON APIs — JSON has no binary type; file contents, encryption outputs, and raw bytes are Base64-encoded as strings.
• JWT tokens — the three dot-separated segments are Base64URL-encoded JSON (header and payload) and a Base64URL-encoded signature.
• MIME email attachments — email protocols transport files as Base64 blocks with line breaks every 76 characters.

When not to use Base64:

• Do not use it as encryption. Base64 provides zero confidentiality — anyone can decode it. Use AES-GCM or another authenticated encryption scheme instead.
• Avoid inline Base64 for large files. Embedding a 500 KB image as a Base64 data URI inflates the HTML by ~667 KB, defeats CDN caching, and increases initial parse time. Serve files separately.
• Avoid it in performance-critical paths. Base64 encoding/decoding is fast, but the 33% size overhead increases bandwidth usage on every request that carries the encoded data.