Base64 Encoder / Decoder

Paste text to encode it to Base64, or paste Base64 to decode it back to text. The converter picks the direction automatically, handles UTF-8 correctly (accents, Devanagari, emoji), supports the standard, URL-safe and MIME variants, and can encode a file you drop in.

When something fails to decode, it does not just say “invalid input”. It names the problem — the exact character and position, a length that cannot be Base64, padding in the wrong place, or the wrong alphabet — and offers a one-click fix. Paste a JSON Web Token and it splits and decodes the header and payload for you. Everything runs in your browser; nothing you paste is uploaded or stored.

What this Base64 tool does

• Picks the direction for you — it decodes only when the input genuinely decodes to something meaningful, and encodes otherwise. You can override it.
• Correct UTF-8 — accented Latin, Indic scripts, CJK and emoji all survive the round trip. The browser’s own btoa() throws on every one of them.
• All three variants — standard, URL-safe (RFC 4648 §5) and MIME with 76-character lines, matching Java’s Base64.getEncoder(), getUrlEncoder() and getMimeEncoder().
• Errors that name the problem — the offending character and its position, impossible lengths, misplaced padding, mixed alphabets, and non-canonical trailing bits.
• JWT breakdown — header, payload and signature separated, claims listed, and exp / iat / nbf shown as dates.
• Files and images — drop a file to encode it, as raw Base64 or a data: URI. Decoded output is identified by file signature and images are previewed.
• Hex view — a proper offset/hex/ASCII dump for binary payloads.
• Java snippets for every case, including the mistakes that reach production.

What Base64 actually is

Base64 represents arbitrary binary data using 64 printable characters. Every 3 bytes (24 bits) are split into 4 groups of 6 bits, and each group becomes one character from the alphabet A–Z a–z 0–9 + /. When the input length is not a multiple of 3, the output is padded with = so it stays a multiple of 4 characters.

That 3-to-4 ratio is why Base64 always grows data by about 33%. It exists so binary can travel through channels that only accept text: email bodies, JSON payloads, HTTP headers, XML documents, and source files.

Base64 is not encryption

This is worth stating plainly, because it causes real security incidents. Base64 has no key and no secret. Anything encoded with it can be decoded by anyone, instantly, using a page like this one. A Base64-encoded password is a plaintext password with extra steps.

The same applies to HTTP Basic authentication: the Authorization: Basic header is nothing more than username:password in Base64, which is precisely why Basic auth must only ever be used over HTTPS.

Base64 in Java

Since Java 8 the answer is java.util.Base64. It offers three encoders and three matching decoders, and choosing the wrong pair is a common source of bugs:

// Encode - always name the charset
String encoded = Base64.getEncoder()
        .encodeToString(text.getBytes(StandardCharsets.UTF_8));

// Decode - the charset is not optional here either
String text = new String(Base64.getDecoder().decode(encoded),
                         StandardCharsets.UTF_8);

// URL-safe, unpadded: what JWTs and OAuth values use
String token = Base64.getUrlEncoder().withoutPadding()
        .encodeToString(bytes);

Three things to know about the variants. getDecoder() throws IllegalArgumentException on line breaks, while getMimeDecoder() ignores them — so PEM keys and email attachments need the MIME decoder. getUrlDecoder() accepts - and _ but not + and /. And org.springframework.util.Base64Utils has been deprecated since Spring 6.0, while javax.xml.bind.DatatypeConverter was removed in Java 11 along with the rest of JAXB — both should be replaced with java.util.Base64.

The charset bug worth memorising

Base64 encodes bytes. A Java String is characters, so something has to turn characters into bytes first — and if you do not say which encoding, Java uses the platform default:

text.getBytes()                              // wrong: platform default
text.getBytes(StandardCharsets.UTF_8)        // right

new String(decoded)                          // wrong: platform default
new String(decoded, StandardCharsets.UTF_8)  // right

The result is the classic bug where everything works on the developer’s machine and accented characters turn to mojibake in production, because the two JVMs had different default charsets. Java 18 made UTF-8 the default via JEP 400, which helps on new applications, but anything running on an older JDK is still exposed.

Decoding a JWT

A JSON Web Token is three URL-safe, unpadded Base64 segments joined by dots: header.payload.signature. Paste one into the tool and it decodes the first two and lists the claims. Two points that follow from this:

• A JWT is signed, not encrypted. Anyone holding the token can read every claim inside it. Never put a secret in a payload.
• Decoding is not verifying. This page cannot check the signature, because that needs the secret or public key your server holds. Anyone can forge a payload and Base64 it — only a verified signature makes claims trustworthy.

Frequently asked questions

Is my data sent to a server?

No. Encoding and decoding happen in your browser with JavaScript. Nothing you paste is uploaded, logged, stored, or placed in the URL, and files you drop in are read locally with the FileReader API. That matters here more than on most tools, because people paste tokens and credentials into Base64 decoders.

Is Base64 encryption? Is it secure?

No, and this is the most important thing to understand about it. Base64 is an encoding, not encryption: there is no key, and anyone can reverse it in a second. Base64-encoding a password, an API key or a token protects nothing. It exists to carry binary data safely through channels that only accept text.

Why does my encoded text look wrong for accented characters or emoji?

Because Base64 encodes bytes, not characters, so the result depends entirely on which character encoding produced those bytes. This tool always uses UTF-8. In Java the equivalent mistake is calling text.getBytes() without a charset, which uses the platform default and gives different output on different machines.

What is URL-safe Base64 and when do I need it?

Standard Base64 uses + and / as its last two characters, and both break inside URLs, query strings, filenames and cookies. The URL-safe variant defined in RFC 4648 section 5 replaces them with - and _, and usually drops the = padding. JSON Web Tokens use it, as do many Spring Security and OAuth values. Switch the Alphabet control to URL-safe.

Why does my Base64 fail to decode?

The usual causes are a length that is not a valid Base64 length, a character from the other alphabet, line breaks from an email or PEM file, padding that has been stripped or doubled, or a JWT being pasted whole instead of one segment at a time. This tool names the specific problem and the character position rather than reporting a generic failure.

Can I decode a JWT here?

Yes. Paste the whole token and it splits into header, payload and signature, decodes the first two, and lists the claims with exp, iat and nbf converted to readable dates. It cannot verify the signature, because verification needs the secret or public key that only your server holds. Decoding a token never proves it is valid.

How much larger does Base64 make my data?

About 33% larger, because every 3 bytes become 4 characters, plus padding and any line breaks. A 30 MB file becomes roughly 40 MB of text. That is why storing images as Base64 in a database column or a JSON response is usually a mistake: it costs a third more space and cannot be streamed.

Can I encode an image or a PDF?

Yes. Open "Encode a file to Base64" and drop a file in. You can output plain Base64 or a complete data: URI ready to paste into CSS or an img tag. Decoded output is also detected by file signature, so an encoded PNG, JPEG, PDF, ZIP or Java class file is recognised and images are previewed.

More developer tools

Other free, client-side tools on javahandson.com: JSON Formatter & Validator, Unix Timestamp Converter, application.properties ↔ application.yml Converter and the MCP Config Generator & Validator.