Base64 Encode and Decode - Text and Files, No Upload

Base64 Encoder and Decoder

What do you want to do?

Drop any file here to encode it

or type below — nothing is uploaded

Text to encode

URL-safe alphabet - and _ instead of + and /, for URLs, file names and JWTs Add padding the = signs that round the length up to a multiple of 4 Add a data: URI prefix data:image/png;base64, — for embedding in HTML or CSS

Line length

Base64

Type text or drop a file to get Base64, or paste Base64 to get the text or the file back. It reads UTF-8 correctly, accepts the URL-safe alphabet, missing padding and line breaks, and when a string cannot be decoded it says exactly why and where. Images and other files are recognised from their first bytes and offered as a download. Everything runs in your browser; nothing is sent to a server.

Nothing is uploaded — the file stays on your device
No file size limit
No sign-up, no watermark
Free, with no paid tier holding anything back

How to encode and decode Base64

Choose Encode or Decode at the top.
Type or paste into the box — or drop a file. To encode an image or a PDF, drop it; to decode one, paste its Base64 and the file type is recognised for you.
Set the options that match where the result is going: the URL-safe alphabet for a URL or a JWT, no padding if the receiver wants none, a data: prefix for HTML or CSS, or line breaks at 64 or 76 characters for PEM and e-mail.
Copy the result, or download it. A decoded file is saved with the right extension.

Why decoding fails, and how to tell which reason

Most Base64 problems are one of five things, and each looks different once you know what to look for. The decoder checks for all of them and says which one it found:

A character that does not belong, reported with its position. A % means the text was URL-encoded first: %3D is =, %2B is +, %2F is /. A quotation mark or a space of another kind means it was copied out of JSON or a document.
An impossible length. Base64 turns 3 bytes into 4 characters, so a length that leaves a remainder of 1 after dividing by 4 cannot be right: a character went missing or the text was cut off.
An = in the middle. Padding only ends a string. Two encoded strings pasted together have padding in the middle.
Two alphabets in one string. Standard Base64 uses + and /; the URL-safe form uses - and _. A real string uses one of them.
The wrong text encoding. The decode is fine but the letters are wrong. See the next section.

Things that are not errors are accepted and mentioned: line breaks every 64 or 76 characters, a missing = at the end, quotation marks around the whole value, a data: prefix, and the URL-safe alphabet.

The same letter, two encodings

Base64 turns bytes into text, and a letter becomes bytes according to a text encoding. The letter é is w6k= in UTF-8 and 6Q== in Latin-1 — both checked against Python's base64 module. The browser's own btoa function uses Latin-1, so it gives 6Q== and, for anything past Latin-1 such as é世, refuses with an InvalidCharacterError. This page encodes text as UTF-8, which is what almost every modern system expects, and reads decoded bytes as UTF-8 too.

If you decode 6Q== as UTF-8 you get a single byte, 0xE9, which is not valid UTF-8, so the page says the result is not readable as text and suggests Windows-1252 — where 0xE9 is é. That is the usual explanation when a string from an older system decodes into question marks or boxes.

Files, images and data URIs

Drop a file in Encode mode and its Base64 comes out, optionally with a prefix such as data:image/png;base64, that browsers accept in an <img> or a CSS url(). Going the other way, the first bytes of the decoded data are compared with the signatures of PNG, JPEG, GIF, WebP, BMP, PDF, ZIP, gzip, 7-Zip and ICO, so a pasted image is shown and downloaded as an image rather than as a heap of characters. Base64 makes data about a third larger: 1,000,000 bytes always become 1,333,336 characters with padding. That is why inlining a large image in a page is rarely a saving.

Tokens, encoded twice, and other special cases

A JSON Web Token is three URL-safe Base64 pieces joined by dots. Paste one, with or without Bearer in front, and the header and payload are shown as formatted JSON. The signature is not checked — decoding a token says what it claims, not whether the claim is true. If a decoded result is itself Base64 — a value that was encoded twice — the page says so and offers to decode it again.

How it was checked

The encoder and decoder are written out here rather than built on btoa and atob, so the output was compared with Python's base64 module: 47 input lengths from 0 to over 100,000 bytes in the standard alphabet, the URL-safe alphabet, without padding, and wrapped at 64 and 76 columns, all identical; then 80 random strings written in six different ways — padded, unpadded, URL-safe, wrapped, split by spaces and tabs — decoded back to the same bytes. A 30 MiB block encodes in about a fifth of a second in Chrome on the machine these pages are built on, and decodes in about a second.

Base64 is not encryption

There is no key and no secret: anyone can decode Base64, so it does not protect a password, a token or a file. Its job is to let bytes travel through places that only carry text — e-mail bodies, JSON, URLs, HTML. At least one widely used Base64 page sends what you type to its own server unless you switch on an in-browser mode; here the work is done in the page and nothing is uploaded, which matters when the string in front of you is a credential.

To turn an image into a Base64 data: string in one step, use image to Base64. To tidy the JSON that a decoded string turns out to contain, paste it into the JSON formatter. To check the integrity of a file you are about to encode, the hash generator gives its SHA-256.

Frequently asked questions

How do I decode Base64 to text?

Switch to Decode, paste the Base64, and the text appears below. Spaces, line breaks and a missing = at the end are all accepted. If the bytes are valid UTF-8 they are shown as text; if they are a known file type, such as a PNG or a PDF, you are told and can download the file.

Why does my Base64 string fail to decode?

The page tells you which of the usual causes applies. A character outside the alphabet, with its position - often a % from URL encoding or a stray quote. A length that leaves a remainder of 1 when divided by 4, which means a character was lost. An = in the middle, which means two encoded strings were joined. Or both the + / and - _ alphabets in one string. Each has its own message.

What is URL-safe Base64?

It is the same encoding with - and _ in place of + and /, because + and / have special meanings in URLs and file paths. It is used in JWTs and many APIs, and often written without the = padding. Decoding here accepts it without any setting; to produce it, tick URL-safe alphabet and untick Add padding if the receiver expects none.

Why do accented letters come out wrong?

Base64 encodes bytes, and the bytes of a letter depend on the text encoding. The letter e-acute is w6k= in UTF-8 but 6Q== in Latin-1, and the browser's own btoa function uses Latin-1 and refuses anything beyond it. This page encodes text as UTF-8. If a string comes from an older system and the letters look wrong, switch the decoder to Windows-1252.

Can I convert an image or a PDF to Base64 and back?

Yes. Drop the file in Encode mode to get its Base64, with a data: prefix if you want to embed it in HTML or CSS. To go back, paste the Base64 in Decode mode: the file type is recognised from its first bytes, images are previewed, and Download saves it with the right extension.

Is Base64 encryption?

No. It is a reversible way of writing bytes as text, with no key. Anyone can decode it, so never use it to hide a password or a token. Its job is to let binary data travel through systems that only handle text, such as e-mail bodies, JSON and URLs.

Is my data uploaded?

No. Encoding and decoding are plain JavaScript on this page, and files are read with the browser's own file API. Some other Base64 pages upload your input to their server by default, which matters if the text is a token or a private file.