Base64 Encoder / Decoder — Convert Base64 Online

What Is Base64 Encoding?

How to Encode Text to Base64

How to Decode Base64 to Text

Common Uses for Base64 Encoding

What It Is

Base64 is a binary-to-text encoding that represents arbitrary bytes using only 64 printable ASCII characters (A–Z, a–z, 0–9, plus + / =). It exists because many internet protocols — email (SMTP), HTTP headers, JSON, XML, URLs, and config files — were designed for text and choke on raw binary. Encoding bytes to Base64 makes them safe to embed anywhere text travels: a PNG thumbnail in a CSS data URI, a TLS certificate in a PEM file, a JWT signature in a header, a username:password pair in an HTTP Basic Auth header, or a binary attachment in a MIME email. The DigiMetrics Base64 tool encodes and decodes in your browser — your input never leaves your tab.

How It Works

Base64 takes input three bytes (24 bits) at a time and re-groups them into four 6-bit chunks. Each 6-bit value (0–63) maps to a single character in the Base64 alphabet. If the input length isn't a multiple of three, the encoder pads the final group with one or two = characters so decoders know how much real data is in the last quartet. Decoding reverses the process: strip the padding, look up each character's 6-bit value, and reassemble 24-bit groups back into 8-bit bytes. The 33% size overhead (4 chars per 3 bytes) is the price of staying in the printable-ASCII range.

Real-World Examples

An API consumer encodes 'user:pass' to get the value for an HTTP Authorization: Basic header. A frontend developer embeds a 4 KB SVG icon as a base64 data URI so the page renders without a separate HTTP request. A backend engineer decodes the payload of a JWT to inspect its claims (header, payload, and signature are all Base64URL-encoded). A DevOps engineer pastes a kubeconfig secret value to decode it and check which cluster credentials are inside. A security researcher decodes a suspicious string from a phishing email and finds an obfuscated PowerShell command.

Common Mistakes to Avoid

Treating Base64 as encryption — it isn't. Anything you encode is trivially decoded by anyone who sees the string; it's encoding, not security. Confusing standard Base64 with Base64URL (the JWT variant), which swaps + for - and / for _ and drops padding. Forgetting to UTF-8 encode multi-byte characters before Base64 encoding, which corrupts emoji and non-Latin scripts. Pasting Base64 with embedded whitespace or line breaks and assuming the decoder will handle it (most do, but some strict parsers don't). And encoding huge files in the browser — Base64 was designed for kilobyte payloads, not gigabyte uploads.

Security Implications

Base64 is reversible plain text. If you see credentials, tokens, or PII Base64-encoded in a request body or cookie, treat them as fully exposed. Never store passwords Base64-encoded — use bcrypt, scrypt, or argon2. Never use Base64 as a 'tamper-proof' format; signed tokens (JWT, PASETO) exist precisely because Base64 alone offers zero integrity. On the defensive side, attackers love Base64 for obfuscating payloads in phishing macros, exfil traffic, and webshells. A spike in suspicious Base64 strings in your access logs is a red flag worth investigating.

Best Practices

Pick the right variant: standard Base64 for general purposes, Base64URL for anything inside a URL or JWT. Strip whitespace before decoding when you control the source. For binary data embedded in JSON, Base64 is the industry default — don't invent something custom. For embedding images in HTML/CSS, prefer real image URLs over data URIs once the asset is larger than ~1 KB; data URIs bloat the parent document and skip the browser cache. And always round-trip (encode then decode) when adding Base64 to a pipeline for the first time, to confirm character-set assumptions.

Troubleshooting Guide

Decoded output looks like garbage? Your input is probably Base64URL while the decoder expects standard Base64 — replace - with + and _ with /, then add = padding until the length is a multiple of 4. Decoder throws 'invalid character'? There's whitespace, a quote, or a stray newline mid-string; strip non-alphabet characters first. Encoded output works in one language but breaks in another? You hit the byte-order mark or UTF-16 vs UTF-8 mismatch; normalize to UTF-8 before encoding. Padding errors? Standard Base64 requires the output length to be a multiple of 4, padded with = if needed.