Understanding Base64
Base64 rewrites arbitrary bytes using 64 printable ASCII characters, so binary survives a channel that only understands text. Three bytes go in and four characters come out, which is why the result is always about a third larger than the input.
hello → aGVsbG8= — five bytes become eight characters, the last group padded out to four with a single =
It is neither compression nor encryption: there is no key, every language ships a decoder, and nothing you encode is hidden. The one choice that matters is the alphabet — standard Base64 ends in + and /, which both mean something inside a URL, so anything bound for a URL, a filename or a JWT wants the URL-safe switch and its - and _. Everything here runs on your device; no file is uploaded.
Why encode to Base64
Plenty of formats are text-only by design. Email bodies, JSON payloads, XML documents, HTTP headers and YAML files all expect characters rather than raw bytes. Drop a PNG straight into any of them and the first byte outside the printable range breaks the parser.
Base64 gives those bytes a safe disguise. An image can be embedded in a stylesheet, a certificate can be pasted into a config file, and a binary attachment can move through a mail server written decades ago — none of which needed changing.
The cost is size and readability. A megabyte of input becomes roughly 1.37 MB of output, and no human can read it. Reach for it when the channel demands text, not out of habit: if you control both ends and they speak binary, send binary.
Variants of Base64
The variants in daily use differ in only two places — the last two characters of the alphabet, and whether the output carries its padding.
| Variant | Alphabet tail | Padding | Best for |
|---|---|---|---|
| standard | + and / | Required | MIME, email, and most APIs and libraries |
| base64url | - and _ | Usually dropped | URLs, filenames, and JWT segments |
| data URI | + and / | Required | Inline images in CSS, HTML, and Markdown |
RFC 4648 also defines base32 and base16 for cases where case-insensitivity matters more than density. Despite the different name, base64url is the same encoding — only the two final symbols change, so a decoder that accepts both, like this one, never has to be told which it is reading.
Every option, and when to use it
The defaults — UTF-8, standard alphabet, padded, one continuous payload — are what you want most of the time. The rest of the controls exist for the cases where the receiving system is stricter, older, or expects a particular shape.
| Option | What it does | Reach for it when |
|---|---|---|
| Character set | Decides how text becomes bytes when encoding, and how bytes become text when decoding. | The data is not UTF-8 — a Windows-1252 spreadsheet export, an ISO-8859-2 dump, a Shift_JIS log. |
| Line endings | Rewrites every line break in the result to LF, CRLF, or CR, whatever the input used. | The receiver is strict about it, such as Windows tooling or a protocol that demands CRLF. |
| Each line separately | Converts one line at a time instead of treating the whole box as a single payload. | You have a list — one token, id, or string per line — and want a result for each. |
| URL-safe | Swaps the final two alphabet characters, + and /, for - and _. | The result goes into a URL, a filename, or a JWT segment. |
| Padding | Adds the trailing = characters so the length is always a multiple of four. | The receiver expects it. Leave it off for base64url, which conventionally drops it. |
| Split at 76 chars | Folds the encoded output into 76-character lines. | You are writing a MIME body or a PEM-style block, both of which expect wrapped text. |
| Data URI | Prefixes the payload with data:<type>;base64, using the file's own media type. | The result is going straight into CSS, HTML, or Markdown as an inline asset. |
Two things about character sets are worth knowing. Encoding can only write a set this page can also invert, so the multi-byte East Asian sets — Shift_JIS, GBK, GB18030, Big5, EUC-JP, EUC-KR — are offered when decoding but not when encoding. And a set narrower than your text will say so: type an emoji with ASCII selected and you get the exact position that cannot be written, rather than a silently corrupted byte.
The options also constrain each other, and the interface follows suit rather than producing something broken. A data URI describes one continuous standard-alphabet payload, so switching on URL-safe, line wrapping, or per-line conversion greys it out. Encoding a file ignores the character set and line endings entirely, because a file is already bytes and has no line structure to normalise.
How our converter works
Everything on this page runs on your device. The encoder walks the input three bytes at a time — twenty-four bits divide evenly into four six-bit numbers, and each number selects one character — and the decoder folds those four characters back into three bytes. There is no server call and nothing is stored.
Text becomes bytes before it is encoded, and which bytes depends on the source character set. UTF-8 is the default and the only one that carries every script; pick Windows-1252 or ISO-8859-2 and anything outside that set is reported rather than silently mangled. Decoding applies the same choice in reverse, so a payload written in Shift_JIS reads back as Japanese instead of mojibake. Converters built on the browser's own btoa can do none of this — btoa throws on any character above U+00FF.
The decoder is deliberately forgiving. It reads either alphabet, ignores line breaks and spaces, tolerates missing padding, and strips a data: URI header when it finds one. What it will not do is guess: a character outside the alphabet is reported with its exact position instead of being silently dropped. Lists can be converted a line at a time, line endings rewritten to LF, CRLF or CR, and encoded output folded at 76 characters the way a MIME body expects.
Use cases
Data URIs are the most visible use. A small icon encoded into a stylesheet saves a request, and an inline preview needs no upload at all.
Credentials and keys are the second. HTTP Basic auth is a Base64 pair, JWT headers and payloads are base64url, and PEM certificates are Base64 wrapped at 64 columns between BEGIN and END lines.
Beyond that: attaching files to a JSON API with no multipart endpoint, storing small blobs in a column that only accepts text, and moving binaries through logs, webhooks, or a paste into a terminal.
Frequently asked questions
+ and /, both of which mean something inside a URL; base64url swaps them for - and _ and usually drops the = padding. Turn on URL-safe above to produce it.File API and converted on your device. The page makes no network request while converting, and nothing you paste, open, or download is ever transmitted.UTF-8 unless you know otherwise — it covers every script and is what the modern web assumes. Reach for another only when the data itself predates that: a Windows-1252 spreadsheet export, an ISO-8859-2 dump, a Shift_JIS log. If a decode comes back as mojibake, the destination character set is usually the thing to change.