Base64 Encoder/Decoder
Convert base64.
Loading tool…
What is Base64?
Base64 is a binary-to-text encoding that represents arbitrary bytes using 64 safe printable characters: A–Z, a–z, 0–9, plus and slash, with equals signs padding the end. It exists because many systems — email headers, URLs, XML and JSON documents, HTTP basic authentication — were designed for text and mangle raw binary data.
The critical thing to understand is that Base64 is not encryption. It provides no secrecy whatsoever; anyone can decode it in a second, which is exactly what this tool does. It is an encoding for safe transport, nothing more. Anything genuinely confidential must be encrypted, and a Base64 string in a config file marked as a secret is not protected in any meaningful sense. The encoding also inflates data by about a third, since every three bytes become four characters.
Why we built this tool
Developers meet Base64 constantly: decoding an HTTP Authorization header, reading a JWT segment, embedding a small asset in a stylesheet, inspecting an encoded payload in a log, or encoding credentials for a client that expects them that way.
Those strings very often contain live credentials — that is the whole point of decoding an Authorization header. Pasting them into a website transmits a working secret to a third party. Ours encodes and decodes in your browser with the native btoa and atob functions, so the string never leaves the tab and no request is made. Even so, rotate any credential you have pasted anywhere, on principle.
Tips and common mistakes
- Base64 is encoding, not encryption — it offers no confidentiality whatsoever.
- Base64URL replaces plus and slash with hyphen and underscore; a standard decoder may reject it.
- Line-wrapped payloads from email headers need the breaks removed before decoding.
- Rotate any credential you have decoded, on principle.
Open Base64 Encoder/Decoder with a link
Base64 Encoder/Decoder can be handed its input by the link that opens it, so the page arrives with the work already done. This is meant for assistants and scripts: if a chatbot, an editor extension, or a command-line agent already holds your content, it can build a link instead of asking you to copy and paste into a box.
The payload rides in the fragment — the part of a URL after the #. Browsers never send the fragment to a server, so anything handed over this way stays on your device exactly as a dropped file would. A link that uses the query string instead is rewritten into the fragment by the page before any analytics or ad script can read the address.
Prefix any field with gz — #gztext= — to pass it as gzip-compressed base64url, which fits roughly five to ten times more into the same link. Links stay reliable up to about 8,000 characters; past that, chat apps and address bars start truncating them, and the page says so rather than loading half a document.
One exception to the privacy rule: ?url= tells the page to download the input from an address. That request goes from your browser straight to that server — not through ours — but it does leave your device, and it only works if the server allows cross-origin requests.
#text=— the text to work on
Example: https://mygadgets.ink/tools/base64-encoder-decoder/#text=...
Quick start: using Base64 Encoder/Decoder
- Paste your text or Base64 string into the input above.
- Choose whether to encode or decode.
- Read the result and check it looks like what you expected.
- If decoding fails, the string is probably truncated or line-wrapped.
- Copy the output — and remember the encoding provides no confidentiality.
For images specifically, see Image to Base64; for tokens, JWT Decoder parses the whole structure.