Need a base64 encoder decoder online? Ours is free, runs entirely in your browser, and doesn't upload whatever you paste — which matters more than people think, because half of what gets base64-decoded at work is API payloads and tokens. Use the base64 encoder/decoder for the quick job, and read on for the five-minute version of what base64 actually does — including the one thing it absolutely does not do.
Base64 solves one specific problem: moving binary data through channels that only speak text. It maps every 3 bytes of input onto 4 characters from a 64-character alphabet (A–Z, a–z, 0–9, +, /), producing a string that survives email systems, JSON fields, XML documents, and URLs without corruption. That's why you see it everywhere binary meets text: images inlined into CSS and HTML as data URIs, email attachments (MIME), API responses carrying file blobs, the payload segments of JWTs, and basic auth headers. It's plumbing — fifty-year-old, boring, everywhere plumbing.
Let's kill the most expensive misconception in this category. Base64 is an encoding, not encryption. There is no key. There is no secret. Anyone — any script, any intern, any attacker — can decode base64 instantly, because decoding requires zero knowledge beyond "this is base64." If you've ever seen credentials "protected" by base64 in a config file, you've seen a padlock drawn on a door with a marker. Encode to transport data; encrypt to protect it. If what you're wrapping is sensitive, it needs real cryptography before it needs encoding — and if you're inspecting hashes along the way, our hash generator is in the same toolbox (hashing, for the record, is a third different thing).
You can spot it by shape: long runs of alphanumerics, maybe a + or /, often ending in one or two = signs. The = is padding — base64 works in 3-byte chunks, and padding fills out the last group, so length is always a multiple of four. Two variants share the streets: standard base64 and base64url, which swaps + and / for - and _ so the output survives URLs without percent-encoding gymnastics. JWTs use base64url, which is why a naive standard decoder occasionally chokes on them. Our decoder handles both, and if you're specifically dissecting tokens, the JWT decoder does the three-segment split for you. For percent-encoding itself, that's the URL encoder/decoder — a different tool for a different escaping problem.
Base64 output is 4 characters for every 3 input bytes — a permanent ~33% size increase. For an icon inlined into a stylesheet, nobody notices. For a 5MB image, base64 turns it into 6.7MB that also can't be cached as a separate asset or lazy-loaded. The practical rule: inline tiny assets (under a few KB) where saving an HTTP request is worth it, and serve real files for everything else. Base64 is a courier, not a compressor — if you want smaller, compress before encoding, never after (encoded output barely compresses, which is also why zipping a folder of base64 strings disappoints everyone involved).
The free base64 encoder/decoder does both directions instantly: paste text or base64, get the other one, copy out. Everything happens client-side — no upload, no signup, no log of your payloads on someone's server. That's deliberate. Developer tools that quietly ship your data upstream to "process" it are a privacy tax nobody agreed to pay, and this entire tool library is built on the opposite premise.
Is base64 reversible? Completely and instantly — that's the point. Decoding requires no key and no secret, which is also why it provides zero security. Anything base64 "hides" is hidden the way a book hides its contents from someone who hasn't opened it yet.
Why does my base64 string end with = or ==? Padding. Base64 processes input in 3-byte groups; when the final group has only 1 or 2 bytes, = characters fill out the block so the output length stays a multiple of four. One leftover byte gives ==, two give =, a clean multiple of three gives none.
What's the difference between base64 and base64url? Two characters: standard base64 uses + and /, which break inside URLs; base64url swaps them for - and _ (and usually drops padding). JWTs, URL tokens, and filenames use the url-safe variant.
Base64 turns binary into safe text at a 33% size premium, decodes with zero secrets required, and protects exactly nothing. Use it for transport, never for security, mind the url-safe variant, and decode locally so your payloads stay yours. That's the whole art.
Your data stays on your machine. The free base64 encoder/decoder runs 100% in-browser — the same local-first principle behind QADIR OS, the sovereign agentic operating system we're building. Join early access — no card required.