Tools › Developer › Base64 encoder
Base64 encoder and decoder
Encode and decode Base64 (text or files, standard or URL-safe) in your browser, with Unicode handled properly rather than mangled.
- Handles Unicode correctly: emoji and accents survive the round trip
- URL-safe variant for JWTs, query strings and filenames
- Encode a file to a data URI, or decode one back to a file
- Nothing is uploaded, decode a token without pasting it into someone's website
What Base64 is actually for
It turns arbitrary bytes into 64 characters that survive anything text can survive: email, JSON, a URL, a copy and paste. That is its entire job. It is not compression: the output is a third larger than the input, and it is not encryption, because anybody can decode it.
You meet it in data URIs, in email attachments, in JWTs, in basic authentication headers, and in any API that has to put a file inside a JSON field.
Unicode, and where most encoders break
The browser's own btoa only accepts characters below 256. Give it an emoji
or a Chinese character and it throws; give it a naive wrapper and you get mojibake back.
The correct order is to encode the text as UTF-8 bytes first and Base64 those bytes.
This page does that, which is why "café 🎉" round-trips here and breaks in a surprising number of online converters. If you have ever decoded something and got "café", that is this bug.
Standard and URL-safe
Standard Base64 uses + and /, and pads with =.
None of those three are safe in a URL: + means a space in a query string,
/ is a path separator and = is a separator too.
The URL-safe variant swaps them for - and _ and usually drops
the padding. It is what JWTs use, which is why a JWT pasted into a standard decoder
frequently fails on the last few characters.
Decoding a JWT safely
A JWT is three URL-safe Base64 sections separated by dots. Decoding the middle one shows you the claims: who the token is for, when it expires, what it grants. That is often exactly what you need while debugging, and it is also a live credential.
Pasting it into a website means handing someone a working token. Here it never leaves the tab, which is the only reason it is safe to do casually. Decoding does not verify the signature, and nothing that reads a token can. Only the holder of the key can do that.
Questions
Is my text uploaded?
No. Everything is encoded and decoded in this tab, which is what makes it safe to paste a token in.
Does it handle emoji and accents?
Yes. The text is encoded as UTF-8 first, which is the step most broken converters skip.
What is the URL-safe variant?
Base64 with - and _ instead of + and /, and usually no padding, so it survives being put in a URL. JWTs use it.
Why did my JWT fail to decode?
It is almost certainly URL-safe Base64 being decoded as standard. Switch the variant.
Does Base64 make my data smaller?
No, about a third larger. It is a way of surviving text-only channels, not a compression scheme.
Is Base64 encryption?
No. Anyone can decode it with no key. It hides nothing from anybody.
Can I encode a file?
Yes. Drop one in and get a data URI, or decode one back to a file.