What Base64 actually does

Base64 rewrites arbitrary bytes using 64 printable characters, so the result can travel through places that only handle text: JSON bodies, cookies, email headers, query strings, a data URL in a stylesheet. Every three bytes of input become four characters of output, and the last group is padded with = so a decoder knows where the data stops.

It is an encoding, not encryption. Anyone can reverse it in one line of code, which is exactly why it must never be used to hide a secret. If a value needs protecting, it needs encryption.

What it is genuinely useful for

  • Embedding a small image or font in a stylesheet as a data URL.
  • Carrying a small binary attachment inside a JSON API request. When the payload on the other end is JSON, the JSON Formatter reads it in a readable shape.
  • Building the value of an HTTP Basic Authentication header.
  • Moving text through a system that mangles spaces, newlines or non-ASCII characters.

For anything large, a binary format or real compression is the better answer. Base64 adds roughly a third to the size of the original data, and it cannot shrink anything.

How to use it

  1. Paste the text into the input panel. Keep Encode to Base64 selected to produce the encoded form, or switch to Decode from Base64 to reverse one.
  2. Tick URL-safe alphabet (- and _) if the value is going into a URL or a JWT. The standard alphabet uses + and /, which have a meaning of their own inside an address. The URL Encoder escapes the characters that still need it.
  3. Copy the result, or download it as a text file.

The Unicode detail that causes most bugs

Encoding happens on bytes, not on characters. Text such as "café" or an emoji takes two to four UTF-8 bytes, and an implementation that encodes the UTF-16 code units instead produces output that decodes into mojibake. This tool converts the text to UTF-8 first, so the round trip is safe for every language and for emoji.

The decoder accepts both alphabets, so a URL-safe value can be pasted straight back in. It also ignores whitespace, which means a Base64 string that arrived wrapped across several lines still decodes.

Good to know

  • The URL-safe option also removes the = padding, which is what the JWT and URL conventions expect.
  • If the value contains characters outside the Base64 alphabet, the decoder says so instead of producing nonsense. A string whose length is one character short of a valid group is rejected for the same reason.
  • Base64 is not encryption. If a value needs to be unreadable to anyone who intercepts it, encrypt it.
  • Expect the output to be about 33 percent longer than the input. If size matters, compress first and encode the compressed bytes.
  • The conversion happens in the browser, so a secret never reaches a server. That also means it never reaches your clipboard history until you copy it yourself.