Base64 encode & decode — offline
Text or files, standard or URL-safe — converted entirely on your device.
Base64 encode and decode without uploading anything
Most Base64 converters are a form that POSTs your input to a server. That is fine for throwaway strings and a poor idea for the things people actually paste into them: credentials from a config file, the body of a signed token, a customer record pulled out of a log line, a certificate. Once that leaves your machine it exists in someone else's request logs.
Nothing is transmitted here. Base64 is a pure function over bytes, and your browser already ships the primitives for it, so this page converts in-tab and the site has no backend to receive an upload in the first place. A Content-Security-Policy blocks third-party requests, and you can confirm the whole thing with DevTools → Network open, or simply by going offline and watching it keep working.
What Base64 does, and why it is not encryption
Base64 maps every 3 bytes of input onto 4 characters drawn from a 64-character alphabet (A–Z, a–z, 0–9, +, /) with = as padding. Its purpose is transport: it lets arbitrary binary data survive channels that only reliably carry text — email bodies, JSON string fields, data URIs, HTTP headers, YAML config.
It provides no confidentiality whatsoever. There is no key, and decoding is not "cracking" — it is just the same table read backwards. A Base64 blob in a config file is exactly as secret as the plaintext it encodes, which is why a Kubernetes Secret is not a secure store and why a "hidden" Base64 API key in client-side JavaScript is simply a published API key. Encoding also costs you size: output is about 33% larger than the input.
For the longer version, see what Base64 is. If you need actual secrecy rather than encoding, that is a job for encryption, not this tool.
URL-safe Base64: the variant used in JWTs and query strings
Standard Base64 produces +, /, and =, all of which have reserved meanings in URLs — + can be read as a space, / splits path segments, and = separates query parameters. The base64url variant defined in RFC 4648 §5 substitutes - for + and _ for /, and drops the padding entirely.
That is the encoding used by every segment of a JSON Web Token, by OAuth PKCE challenges, and by anything that has to survive being pasted into a URL. Toggle URL-safe when encoding to get it. Decoding needs no toggle: this tool normalises - and _ back automatically and re-pads the input, so both variants decode correctly whether or not the padding survived the round trip.
Working with tokens specifically? The JWT decoder splits and decodes all three segments at once, and verifies the signature.
Base64-encode a file, or turn Base64 back into a download
Switch to File mode to encode any file — an image for a CSS data URI, a certificate, a PDF attachment for an API request — straight to a Base64 string you can copy. The file is read straight into an ArrayBuffer in the tab and never posted anywhere, so size is bounded by your available memory rather than by an upload limit.
The reverse works too. Paste a Base64 blob and download the decoded bytes as a real file, which is the quickest way to recover an attachment out of a raw email source or an API response you captured.
Text mode is fully UTF-8 safe, including emoji and non-Latin scripts, because it encodes via TextEncoder rather than the legacy btoa path that throws on any character above U+00FF. Decoding is strict: if a blob turns out to be binary rather than valid UTF-8 text, you get told so explicitly and pointed at File mode instead of receiving a screen of replacement characters.
Also client-side: URL encoder for percent-encoding, and hash generator to checksum the same file.
How to Base64 encode or decode without uploading
- 1
Choose Text or File mode.
- 2
Paste text/Base64, or pick a file to encode.
- 3
Copy the result, or download decoded Base64 as a file.
Base64 Encode/Decode — frequently asked questions
Is my data uploaded to encode or decode it?
No. Base64 conversion happens with your browser's built-in functions — text and files never leave your device.
Does it handle files and unicode text?
Yes — encode any file to Base64, turn Base64 back into a downloadable file, and text mode is fully UTF-8 safe (emoji included).
What is URL-safe Base64?
A variant that replaces + and / with - and _ and drops padding, so the result can live inside URLs and JWTs. Toggle it when encoding; decoding accepts both variants automatically.
Base64 Encode/Decode guides
The Base64 alphabet
The full 64-character table, why the padding character is not part of it, how the URL-safe variant differs, and how to tell standard Base64 from base64url at a glance.
What is Base64 encoding, and when should you use it?
Base64 turns binary data into plain text so it survives systems built for text. Learn what it is, why it makes data ~33% bigger, when to use it, and why it is not encryption.