Skip to content

Base64 Encoder & Decoder

Encode text to standard Base64 (the A-Z a-z 0-9 + / = alphabet) or decode it back, with full Unicode support. Runs in your browser; nothing is uploaded.

How Base64 Mechanics Work

Base64 encoding works by grouping binary data into 24-bit blocks (3 bytes). These 24 bits are then divided into four 6-bit chunks. Each 6-bit chunk maps to an index value (from 0 to 63) in the standard Base64 character alphabet (A-Z, a-z, 0-9, +, /). If the input text length is not a multiple of 3 bytes, padding characters (=) are appended to complete the 4-character block.

Zero-Server Security Compliance

  • Secure local context: Your developers can paste internal keys, JSON configs, or test data without data-leak liability.
  • Native Browser APIs: Bypasses dynamic server scripts by using secure, built-in JavaScript btoa() and atob() engines.
  • Responsive Design: Fits perfectly on mobile or desktop viewports, updating translations instantly as you type.

What this tool outputs, and what it will not

This encoder emits standard Base64, not the URL-safe variant. Both alphabets carry the same 64 values; they disagree on two characters and on padding. Standard Base64 (RFC 4648 section 4) uses + and / for values 62 and 63 and pads to a multiple of four with =. The URL-safe variant (section 5, often called base64url) substitutes - and _ and usually drops the padding, because + means a space in form-encoded query strings and / splits a path.

You can see the difference without leaving this page. Encoding a single grinning-face emoji gives 8J+YgA== — note the +. Encoding ??? gives Pz8/, which ends in a slash. Dropped into a URL unescaped, either one breaks. To convert the output by hand, replace every + with -, every / with _, and strip the trailing = signs. This matters most for JSON Web Tokens: every segment of a JWT is base64url, so pasting one here decodes only if it happens to contain neither substituted character.

Why accented and non-Latin text used to come back wrong

The browser’s built-in btoa() does not take text. It takes a “binary string” in which every character must fit in one byte, so it throws InvalidCharacterError on anything above U+00FF — on €, on Cyrillic, on any emoji.

The quieter failure is worse. Characters that do fit in a byte are encoded as Latin-1 rather than UTF-8, so no error is raised and the answer is simply wrong: café through a naive btoa() yields Y2Fm6Q==, which is four bytes, while the correct UTF-8 encoding is Y2Fmw6k=, which is five. Anything decoding that string as UTF-8 gets a replacement character instead of the é.

This tool runs your text through TextEncoder first and Base64-encodes the resulting UTF-8 bytes, and reverses that with TextDecoder when decoding. Every script round-trips, emoji included.

Known limits

  • Text only. There is no file picker here; the whole string is held in memory as you type. For turning a file into a data URI, use a tool built for it rather than pasting binary into a textarea.
  • Line breaks in the input are ignored when decoding. ASCII whitespace is stripped first, so Base64 wrapped at 76 columns (as MIME does) still decodes. Any other character outside the alphabet is rejected, as is a string whose length leaves a remainder of one when divided by four.
  • Invalid UTF-8 decodes rather than failing. If the bytes are not valid UTF-8 — because the input was a Base64-encoded image, say — decoding substitutes U+FFFD (�) rather than raising an error. Replacement characters in the output mean the payload was not text.
  • Base64 is not encryption. It is a transport encoding with no key and no secret. Anyone holding the string can reverse it here in one paste.

Base64 Encoding & Decoding Frequently Asked Questions

What is Base64 encoding?

Base64 is a binary-to-text encoding scheme that represents binary data in an ASCII string format. It does this by translating data into a radix-64 representation. This is extremely useful for transmitting binary data over channels that only support text-based characters, such as HTML, email headers, XML, and JSON payloads.

Is Base64 secure or encrypted?

No, Base64 is NOT encryption. It is a simple encoding scheme. Anyone who obtains a Base64 encoded string can instantly decode it back to plain text using standard decoders. You should never use Base64 encoding as a security measure for storing or transmitting confidential data, passwords, or sensitive keys.

Does Base64 increase file or text size?

Yes, Base64 encoding increases data size. Because Base64 maps 3 bytes of binary data into 4 ASCII characters, it typically increases the data footprint by approximately 33%. For instance, encoding a 30KB image will result in a Base64 text string of about 40KB in size.

Why is a local offline Base64 tool better?

Many online Base64 converters upload your encoded strings or confidential credentials to remote cloud databases. If you are encoding programmatic passwords, API keys, or JSON web tokens (JWT), this represents a severe compliance hazard. DuckConvert performs all operations entirely in your local browser sandbox, ensuring zero server transit and absolute privacy.