Base64 Encoder / Decoder
Standard base64 (RFC 4648 §4) and URL-safe (§5) variants. Encodes UTF-8 input correctly; decodes attempts to render UTF-8 text and falls back to a hex view if it isn’t printable.
Input
Result
When to use which variant
Standard base64 uses + and /; URL-safe replaces them with - and _ and drops trailing = padding. URL-safe is what FIDO2 / WebAuthn / JWT use.
Spec
RFC 4648 (base64 / base64url).
What is Base64 encoding?
Base64 (RFC 4648) represents arbitrary binary data as ASCII text using 64 printable characters, so bytes can travel safely through channels that expect text — HTTP headers, JSON, XML, email (MIME) and data: URIs. It is an encoding, not encryption: anyone can decode it, and it adds roughly one third to the size of the original data.
Reach for this tool when you need to eyeball a base64 blob from a config file, a JWT segment, or a WebAuthn response, or when you need to produce a base64 string to paste into a request. Worked example: the text hello encodes to aGVsbG8= in standard base64. The trailing = is padding. The URL-safe variant used by JWT and WebAuthn replaces +/ with -_ and usually drops the padding, so the same bytes become aGVsbG8.
Frequently asked questions
Is base64 a form of encryption?
No. Base64 is a reversible encoding with no key, so it provides zero confidentiality. Use it only for transport/representation, never to protect secrets.
What is the difference between standard and URL-safe base64?
Standard base64 uses + and / and keeps = padding; URL-safe base64 (base64url) uses - and _ and typically omits padding so the value is safe in URLs and JSON. FIDO2/WebAuthn and JWT use base64url.
Does this tool send my data anywhere?
No. Encoding and decoding run entirely in your browser; nothing is uploaded to a server.
Why does base64 make my data about a third larger?
It encodes three bytes as four characters, so output is roughly 133% of input size before padding. That is the cost of making arbitrary bytes safe to carry in text.
Why does my base64 string fail to decode?
Usually stray whitespace or newlines from copying, a URL-safe string being decoded as standard (- and _ instead of + and /), or missing = padding.