Free Tool
Base64 Encoder
Base64 turns any text into a string of letters, numbers and a few symbols so it can travel through systems that only handle plain text. Type text below and this tool encodes it in your browser. And read the warning on this page carefully: Base64 is encoding, not encryption — anyone can decode it, and it protects nothing.
Base64 is encoding, not encryption. Encoded text is not secret text. Anyone with a decoder — including the free decoder on this site — can turn it back in one click. Never use Base64 to hide anything.
What this tool does
Computers move data in many forms, and some systems only accept plain text. Email is the classic example: it was built for text, so a photo or a file cannot be sent as raw bytes — it has to be represented as text first. Base64 is the standard way to do that. It takes any bytes and writes them as characters from a 64-character alphabet — upper and lower case letters, digits, plus and slash — with equals signs as padding at the end, so the result is ordinary text that any system can carry.
This encoder takes your text, converts it to UTF-8 bytes and writes those bytes in Base64, all in your browser. You will see the result grow by about a third — that is the cost of the representation — and you will see padding equals signs at the end when the length requires them. The decoder on this site reverses the process in one click, which is the point of the lesson: encoding is a change of representation, not a change of access. No key is needed, no secret is involved, and no security is added.
Base64 shows up in places that confuse people. It appears in passwords' storage formats, in web tokens, in email attachments and in data URLs — and in every one of those places, the Base64 is carrying something else that provides the actual security, if any security exists at all. A password stored as Base64 is stored in plain sight. A token in Base64 is readable by anyone who decodes it. The encoder on this page exists to make that confusion impossible: encode something here, decode it there, and the lesson is learned in ten seconds.
Try it
Type text and encode it. Then take the result to the Base64 decoder on this site and turn it back — that round trip is the lesson.
Waiting. Press Encode to Base64. Remember: this is encoding, not encryption.
How it works
Base64 works on groups of three bytes — 24 bits. It splits those 24 bits into four groups of 6 bits, and writes each group as one character from its 64-character alphabet: A to Z for values 0 to 25, a to z for 26 to 51, 0 to 9 for 52 to 61, plus for 62 and slash for 63. When the input is not a whole number of three-byte groups, equals signs pad the end so the output length is always a multiple of four. That is the whole algorithm — no key, no secret, no randomness.
This page implements it with your browser's built-in functions: it encodes your text as UTF-8 bytes, converts those bytes to a binary string, and passes it to btoa, the browser's standard Base64 encoder. Using the built-in function means the result matches every other correct Base64 tool in the world, including the decoder on this site. The input is handled as UTF-8, so accented characters and emoji encode consistently.
The output is about a third longer than the input, because 6 bits of data per character carry less information than 8 bits per byte. That size cost is the reason Base64 is used only where text-only transport is required, and never as a way to save space. If you are encoding something large, expect it to grow; if you are encoding something secret, stop — Base64 does not protect it.
Limitations
Base64 provides no confidentiality, no integrity and no authentication. It is a representation, not a protection. Encoded text can be decoded by anyone, changed without detection, and read by any system that receives it. If you need privacy, you need encryption; if you need integrity, you need a hash or a signature; Base64 gives you neither.
- The encoder handles text only. Binary data, such as an image file, must be processed by a tool that reads files — this page takes typed text.
- Some systems use a URL-safe variant of Base64, with minus and underscore instead of plus and slash. This page uses the standard alphabet; URL-safe Base64 is a different encoding of the same idea.
- Nothing you type is sent anywhere. The computation is local, and the page works offline once loaded.
Examples
Example 1 — Hello, world. Encoding Hello, world gives SGVsbG8sIHdvcmxk. There is no padding here, because the input length happens to fit. Decode it with the Base64 decoder on this site and you get Hello, world back — the round trip is the proof that encoding is reversible by anyone.
Example 2 — a single character. Encoding A gives QQ==. One byte becomes two characters plus two padding equals signs, because the algorithm works in groups of three bytes and must fill the rest. The padding is part of the format, not a secret: it tells the decoder how many bytes the last group really held.
Example 3 — the mistake to avoid. Someone encodes their password as cGFzc3dvcmQxMjM= and pastes it into a document, believing it is hidden. It is not: anyone who recognises Base64 decodes it in a second and reads password123. Encoding is like writing a message in a different alphabet — it looks different, but anyone who knows the alphabet can read it.
Frequently asked questions
Is Base64 encryption?
No. Base64 is encoding — a change of representation with no key and no secret. Anyone can decode it. It protects nothing, and must never be used to hide sensitive data.
Why does Base64 output end with equals signs?
Padding. Base64 works in groups of three bytes, and when the input does not divide evenly, equals signs fill the last group so the output length is a multiple of four. The decoder uses them to know how many bytes the last group held.
Why is Base64 output longer than the input?
Because each output character carries 6 bits of data instead of 8. The result grows by about a third. That is the cost of representing binary data as text.
Where is Base64 actually used?
In email attachments, web tokens, data URLs and anywhere binary data must travel through a text-only system. In all those places, Base64 carries the data — the security, if any, comes from something else entirely.
What is URL-safe Base64?
A variant that replaces plus and slash with minus and underscore, so the output is safe to put in a web address without extra encoding. Same idea, different alphabet.