Base64 Encoder / Decoder
Encode text to Base64 or decode it back, with full Unicode support — and a clear explanation of why Base64 is not encryption.
Exactly a third larger, always
Base64 takes three bytes — 24 bits — and rewrites them as four characters of six bits each. That is the entire design, and everything else follows from it. The encoded length is exactly ⌈n/3⌉ × 4, and for anything substantial the ratio settles at 4/3: 33.33% larger, never more.
| Encoding | Becomes | Extra |
|---|---|---|
| a 100 KB icon | 0.13 MB | +0.03 MB |
| a 1 MB photo | 1.33 MB | +0.33 MB |
| a 5 MB attachment | 6.67 MB | +1.67 MB |
Which is why attaching a 5 MB image to an email puts about 6.7 MB on the wire, and why embedding images as data URIs costs a third of their size before any compression. It is not an implementation detail that might improve one day — it is arithmetic.
The = signs carry no information at all
Output comes in blocks of four, so an input that is not a multiple of three leaves a partial block and the padding fills it out. How much padding depends only on the length:
| Input length | Padding |
|---|---|
| a multiple of three exactly | none |
| a multiple of three, plus 1 | 2 = signs |
| a multiple of three, plus 2 | 1 = sign |
The decoder can already see the length, so the padding tells it nothing it did not know. That
is why decoders generally accept unpadded input, and why URL-safe base64 drops it entirely. If
you have ever wondered whether a string missing its = is broken — it usually is
not. The one thing padding buys is that encoded blocks can be concatenated and still decoded
separately, which matters for streaming formats and almost nowhere else.
The URL-safe alphabet differs from the standard one in exactly two places — + and
/ become - and _ — because those are the two symbols that
would otherwise need escaping in a URL. Everything else about the encoding is identical.
How to use
- Paste text to encode, or Base64 to decode.
- Switch to the URL-safe variant if the result goes in a web address.
- Copy the output.
- Do not use this to protect anything secret.
Frequently asked questions
Is Base64 encryption?
No, and treating it as such is a genuine security mistake. It is a reversible encoding with no key — anyone can decode it instantly. Its purpose is to let binary data travel safely through systems that expect text, not to hide anything.
Why does Base64 make data bigger?
Because it represents three bytes using four characters, an increase of about 33 per cent. It uses only 64 safe characters, so each one carries six bits instead of eight, and the padding to a multiple of four adds a little more.
What are the equals signs at the end?
Padding. Base64 works in groups of three input bytes, so when the input length is not a multiple of three, one or two equals signs mark the shortfall. Some implementations omit them, and most decoders cope either way.
What is URL-safe Base64?
A variant replacing the plus and slash characters with hyphen and underscore, because plus and slash have special meanings in URLs and file paths. JSON Web Tokens use it, which is why a JWT contains no plus signs or slashes.
Why does my non-English text break?
Because Base64 encodes bytes, not characters, so the text has to be converted to bytes first — normally UTF-8. If the encoder assumes each character is one byte, anything outside ASCII is corrupted. This tool handles UTF-8 correctly, which is why accented and non-Latin text survives the round trip.
Where is Base64 actually used?
Email attachments, data URIs that embed an image directly in a page, JWT tokens, and HTTP basic authentication headers. In each case the need is the same: move arbitrary bytes through a channel that only reliably carries text.
🔒 This tool runs entirely in your browser. Nothing you enter is uploaded, logged, or stored.