Last updated 3 September 2026
What Base64 is (and isn't)
Base64 re-represents data using only 64 safe ASCII characters, which makes it possible to carry binary-ish content through systems that only handle plain text — JSON fields, URLs, email attachments. It is not encryption: anyone can decode it back instantly, with no password or key involved, which this tool demonstrates directly.
Why Unicode needs care
The browser's plain btoa() function only understands single-byte characters, so it breaks on emoji, accented letters, or non-Latin scripts. This tool converts through proper UTF-8 bytes first, so anything you can type encodes and decodes correctly.
What Base64 is for
Base64 exists to move binary data through channels that only reliably carry text. Email attachments, data URIs in CSS, JSON payloads and HTTP headers all fall into that category: they were designed for printable characters, and a raw byte with a high value can be mangled or dropped in transit. Base64 rewrites arbitrary bytes using only 64 safe characters, so whatever comes out the other end is exactly what went in.
The cost is size. Every three bytes become four characters, so encoded output is about 33% larger than the original, plus padding. That is the trade being made — reliability in exchange for bulk — and it is why a Base64 image inlined into a stylesheet is always bigger than the same image served as a file.
Encoding is not encryption
This is the single most common misunderstanding about the format. Base64 uses no key and hides nothing. Anyone who sees an encoded string can decode it instantly, including with this tool. A password, an API key or a token that has merely been Base64-encoded is stored in plain text for any practical purpose.
The confusion often comes from seeing Base64 inside things that are secure. A JWT, for example, has Base64url-encoded segments, but its security comes from the signature at the end, not from the encoding. Similarly, HTTP Basic authentication sends Base64-encoded credentials — which is exactly why it is only acceptable over HTTPS.
Common questions
What is Base64 actually for?
It converts arbitrary bytes into plain ASCII text using only letters, numbers, + and /. That makes it safe to embed binary-ish data — images, files, keys — inside formats that only expect plain text, like JSON, URLs or emails.
Is Base64 encryption?
No. It's an encoding, not a cipher — anyone can decode it instantly with no key required, exactly as this tool does. It provides no confidentiality at all, only a text-safe representation.
Why do some Base64 tools break on emoji or accented text?
The classic browser functions (btoa/atob) only understand single-byte Latin-1 characters. This tool converts through UTF-8 bytes first, so emoji, accented letters and non-Latin scripts encode and decode correctly.
Is Base64 a form of encryption?
No. There is no key and nothing is hidden. Any Base64 string can be decoded by anyone in a second. Use it to transport data safely through text-only channels, never to protect a password, token or key.
What are the = signs at the end?
Padding. Base64 works on groups of three bytes at a time, so when the input length is not a multiple of three, one or two = characters are added to complete the final group. They carry no data and are stripped automatically when decoding.
What is Base64url and why is it different?
A variant that swaps the + and / characters for - and _, because + and / have special meanings inside a URL. It is what JWTs and most URL-safe identifiers use. Standard Base64 pasted into a query string will often be corrupted; Base64url will not.