Is Base64 encoding free and private?

Yes. Base64 encoding and decoding runs entirely in your browser. Your data stays local regardless of input size. Both standard Base64 ( +/ ) and URL-safe Base64 ( -_ ) conversions happen client-side. MIME attachments, JWT segments, and API payloads never touch a server. It is a stateless local character conversion — no input data is sent, stored, or logged.

How do I decode Base64?

Paste your Base64 string into the input field and click decode. The tool automatically handles standard Base64 (with + and / ) and URL-safe Base64 (with - and _ ). If your input includes = padding characters, the tool accepts them too. Toggle the 'URL safe' option if your encoded string uses the Base64URL alphabet. The decoded output appears instantly — copy it with the copy button.

How does Auto mode decide whether to encode or decode?

Auto mode makes a best-effort guess before running: Data URI — input starting with data:image/...;base64, is always decoded (and previewed as an image). Base64 look — if the input contains only Base64 alphabet characters, has a valid length (a multiple of 4 once = padding is accounted for), and decodes cleanly to readable UTF-8 text, it is decoded. Everything else — text with spaces, punctuation, or non-ASCII characters is treated as plain text and encoded. The guess is shown in a small notice under the mode buttons, and you can always switch to explicit Encode or Decode to override it.

Why do decode errors say more than "Invalid input"?

Most Base64 tools collapse every failure into one generic message. This one reports the actual problem: Invalid character — a character outside the Base64 alphabet, reported with its position. Missing padding — the length isn't a multiple of 4; the message tells you how many = characters to add. Wrong mode — if the input doesn't look like Base64 at all (spaces, punctuation, non-ASCII), the tool suggests you meant to Encode instead. URL-safe hint — input using - / _ prompts you to enable the URL safe option (or switch to Auto).

What is the "chunked btoa" note about?

The browser's btoa() function converts a binary string to Base64, but it can throw a call-stack or argument-length error when handed very large strings in a single call. This tool encodes in 32 KB chunks ( 0x8000 characters at a time), which keeps each btoa() call small and predictable — so large text and dropped files encode smoothly in any browser.

Base64 Encode/Decode — Auto-Detect, Image Preview & Data URI

Encode text or files to Base64, decode Base64 back to text, and preview data:image/...;base64, images inline. Auto mode guesses encode vs decode, and errors say exactly what went wrong.

Result

InputURL safe (base64url)

What is Base64 Encoder / Decoder?

Base64 is a binary-to-text encoding scheme that represents arbitrary data using 64 printable ASCII characters. It's the most widely used encoding format on the web.

64 characters — A-Z, a-z, 0-9, +, and / (with = for padding).

33% overhead — every 3 bytes of input becomes 4 characters of output.

URL-safe variant — replaces + with - and / with _ for safe use in URLs and filenames.

Image preview — pasting a data:image/...;base64, URI (or any Base64 whose bytes match a PNG/JPEG/GIF/WebP/AVIF signature) renders it inline, with a "Copy data URI" action.

Auto-detect — unsure whether your input is text or Base64? Auto mode guesses from the alphabet, length, and whether it decodes to readable UTF-8.

Specific decode errors — invalid character, missing padding, or a mismatch that suggests the wrong mode.

Chunked btoa — the encoder feeds large inputs through btoa() in 32 KB chunks, so big files never hit the browser call-stack limit.

Not encryption — Base64 is reversible by anyone; it provides zero confidentiality.

Zero-Server Tool Data Guarantee

All encoding, decoding, and image previews happen locally in your browser. Text, files, and images never leave your device — no server upload, no logging, no tracking of your data.

How to Use

Pick a Mode

Auto guesses encode vs decode from your input; Encode converts text or files to Base64; Decode reverses the process.

Paste, Type, or Drop a File

Paste text, a Base64 string, or a data:image/...;base64, URI — or drag a file into the input area.

Toggle URL-Safe

Enable 'URL safe (base64url)' to produce JWT/URL-friendly output with - and _ instead of + and /.

Review the Result

Decoded text appears instantly; Base64 that decodes to an image (PNG/JPEG/GIF/WebP/AVIF) renders an inline preview.

Copy

Use the copy button for text output, or 'Copy data URI' to grab the full data:image/...;base64, string.

Common Use Cases

Embed Images in HTML/CSS

Convert binary image data to Base64 for inline data URIs, eliminating separate HTTP requests.

Email Attachments

SMTP only supports 7-bit ASCII; Base64 encodes binary attachments for transport through email systems.

JSON Data Transport

Embed binary data (files, certificates, keys) directly in JSON strings using Base64 encoding.

API Authentication

HTTP Basic Auth uses Base64 to encode 'username:password' in the Authorization header.

Implementation Examples

JavaScriptBrowser (btoa/atob)

// Encode
const encoded = btoa('hello world'); 
// "aGVsbG8gd29ybGQ="

// Decode
const decoded = atob('aGVsbG8gd29ybGQ=');
// "hello world"

// URL-safe variant
const urlSafe = btoa('hello?world=')
    .replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');

Base64 vs Base85 vs Hex

Encoding	Overhead	Character Set	Use Case
Base64	33%	64 chars (A-Z, a-z, 0-9, +, /)	Web, email, APIs, data URIs
Base85	25%	85 chars (printable ASCII)	PostScript, PDF, compact storage
Hex (Base16)	100%	16 chars (0-9, a-f)	Debugging, crypto hashes
Base32	60%	32 chars (A-Z, 2-7)	2FA secrets, case-insensitive

Production Best Practices & Security

Never use Base64 for security — it's an encoding, not encryption. Anyone can decode it. Why:Base64 is just a way to represent binary data in text format; it provides zero protection or confidentiality, so never rely on it to protect passwords or personal data.

Use URL-safe Base64 in URLs — standard Base64 characters (+, /) break URL parsing. Why:'+' and '/' have special meanings in URLs; the URL-safe variant (replacing them with '-' and '_') keeps data from getting corrupted.

Prefer real assets over data URIs for large images — data URIs inflate size by ~33% and can't be cached. Why:the browser still has to download every byte; separate image files let it cache and load in parallel.

Use for data transport, not storage — Base64 increases size by 33%; prefer binary storage when possible. Why:3 bytes of data becomes 4 characters, so the overhead adds up in large databases or file systems.

Check for valid input — ensure the input has the correct length and valid characters before decoding. Why:decoding an invalid Base64 string can crash or misbehave; this tool reports the exact character, position, or missing padding.

Use Base85 for better efficiency — if size matters, Base85 encodes 4 bytes in 5 chars (25% overhead). Why:when you're space-constrained but must use a text-based format, Base85 is denser than Base64.

Keep base64url unpadded when a spec demands it — JWT and OAuth remove trailing = characters. Why:some parsers reject padding; Auto mode re-adds it when needed for decoding.

Frequently Asked Questions

Base64 encodes binary data into a safe ASCII string using 64 characters (A-Z, a-z, 0-9, +, /) with = padding.

You need it whenever binary data must travel through text-only channels: embedding images in HTML/CSS (data: URLs), attaching files to emails (MIME), encoding binary in JSON fields (API responses, JWTs), storing binary in text databases, and transmitting cryptographic keys (PEM format wraps Base64).

Base64 is not encryption — it is encoding. Anyone can decode it instantly without a key.

No — this is a common misconception. Base64 is an encoding scheme, not encryption.

Encoding transforms data from one format to another using a public, reversible algorithm. Anyone with a Base64 decode tool can instantly recover the original. There is no secret key involved.

Do not use Base64 to protect sensitive data like passwords, credit card numbers, or personal information. If you need confidentiality, use actual encryption (AES, XChaCha20) instead of, or on top of, Base64.

Standard Base64 uses + and /, which have special meaning in URLs. A + is decoded as a space in query strings, and / is a path separator.

URL-safe Base64 (Base64URL, RFC 4648 section 5) replaces + with - and / with _, and strips trailing = padding. For example, a+b/c== becomes a-b_c — shorter and URL-safe.

Use this option when your encoded string will go into URL query parameters, path segments, or JWT tokens.

A data URI embeds a file directly inside a URL, using the data: scheme — for example data:image/png;base64,iVBORw0KGgo.... The file's bytes are Base64-encoded and pasted right into the URI, so no separate HTTP request is needed.

They are handy for small images in HTML or CSS (<img src="data:...">), icon libraries, self-contained email signatures, and offline pages. The trade-off: the embedded data is about 33% larger than the original binary file, and the URI can't be cached like a real asset, so use them for small assets only.

This tool detects the data:image/...;base64, prefix, renders the image, and offers a Copy data URI action.

Auto mode makes a best-effort guess before running:

Data URI — input starting with data:image/...;base64, is always decoded (and previewed as an image).
Base64 look — if the input contains only Base64 alphabet characters, has a valid length (a multiple of 4 once = padding is accounted for), and decodes cleanly to readable UTF-8 text, it is decoded.
Everything else — text with spaces, punctuation, or non-ASCII characters is treated as plain text and encoded.

The guess is shown in a small notice under the mode buttons, and you can always switch to explicit Encode or Decode to override it.

Most Base64 tools collapse every failure into one generic message. This one reports the actual problem:

Invalid character — a character outside the Base64 alphabet, reported with its position.
Missing padding — the length isn't a multiple of 4; the message tells you how many = characters to add.
Wrong mode — if the input doesn't look like Base64 at all (spaces, punctuation, non-ASCII), the tool suggests you meant to Encode instead.
URL-safe hint — input using -/_ prompts you to enable the URL safe option (or switch to Auto).