Is Base64 encryption?

No. Base64 is encoding, not encryption. Anyone can decode it without a key. Don't use Base64 to hide secrets — use real encryption.

When should I use URL-safe Base64?

Whenever the encoded value will appear in a URL, query parameter, filename, or anywhere '+', '/', or '=' would need to be percent-encoded. JWTs and many web APIs use URL-safe Base64.

Can I encode an image to use in a CSS data URL?

Yes. Click 'Encode a file', pick the image, and copy the result. Wrap it as `data:image/png;base64, ` in your CSS or HTML.

Why does my decoded text look like garbage?

If the input wasn't valid Base64, or it was URL-safe Base64 decoded as standard Base64 (or vice versa), the result will be garbage. Toggle the URL-safe option and try again.

Are my files uploaded?

No. Base64 encoding and decoding both happen in your browser. Files never leave your device.

Developer Tools

Base64 Encode / Decode

Encode and decode Base64 strings or files. Supports URL-safe Base64 (base64url).

URL-safe (base64url)

Plain text or file

Output

Files processed in your browser

Your files never leave your device. No upload, no servers.

About Base64 Encode / Decode

Base64 Encode / Decode converts text or binary data to and from Base64 — the standard ASCII-safe encoding used to embed images in CSS, send binary data over text-only protocols, and pass values through URLs that don't tolerate special characters. Switch between Encode and Decode with a single click; toggle URL-safe Base64 (base64url) when you need a result that's safe inside a URL or filename. The tool runs entirely in your browser. Text inputs are decoded with full Unicode (UTF-8) support, so emoji, accented characters, and non-Latin scripts encode and decode correctly. You can also pick a file from your device — its raw bytes are encoded directly without leaving your browser, useful for embedding small images as data URIs or inspecting how a file gets serialized. Common uses include encoding small images for inline embedding in HTML or CSS, decoding the payload of a Base64-encoded API response, encoding credentials for HTTP Basic Auth (user:pass → Base64), generating data: URLs for prototypes, and inspecting Base64 fields inside JWTs, JSON Web Encryption envelopes, or webhook payloads. The decode-to-file action is handy when you receive a Base64 blob and want to save it back as the original binary. Standard Base64 uses '+' and '/' characters and pads with '=', which causes problems in URLs and filenames. URL-safe Base64 (sometimes called base64url) replaces '+' with '-', '/' with '_', and drops the padding. Use the URL-safe toggle when working with JWTs, OAuth tokens, or anywhere the result needs to survive URL encoding intact.

How Base64 Encode / Decode works

Paste text or pick a file. The tool detects whether you want to encode or decode based on your input mode.
Toggle URL-safe Base64 (base64url) if your output needs to be embedded in a URL, query string, or filename.
Encoding converts every 3 input bytes to 4 ASCII characters from the Base64 alphabet.
Decoding reverses the process and gives back the original text (UTF-8 decoded) or downloadable binary.
Copy the result, or for files, save the decoded blob back to disk.

When to use Base64 Encode / Decode

Embed a small image as a data: URI inside CSS or HTML so the page makes one fewer request.
Decode the payload of a Base64-encoded API response or webhook event.
Encode HTTP Basic Auth credentials (user:pass → Base64) for a one-off API test.
Inspect the header or payload of a JWT (which uses URL-safe Base64).
Pass binary data through a system that only accepts text — like an email body, a CSV column, or a JSON field.
Convert between standard Base64 and URL-safe Base64 when integrating two services that disagree on the format.

Why choose Utilix Base64 Encode / Decode

Full UTF-8 support — emoji, accented characters, and non-Latin scripts encode and decode correctly.
Both standard and URL-safe Base64, with a one-click toggle.
File encoding/decoding without size limits beyond what your browser memory allows.
All processing local — safe for tokens, credentials, and confidential payloads.
Open-source approach: the encoding logic uses standard browser APIs you can verify.