Base64 Decode & Encode

Decode Base64 to text, an image, or the original file — or encode text and files to Base64. UTF-8 safe, so emoji and accents survive, with Base64URL, JWT decoding, and image-to-data-URI conversion. Free, and it all happens in your browser: tokens and files never leave your device.

Try it:
Base64

File to Base64

Turn an image, icon, or font into a data URI for HTML and CSS — or any file into plain Base64.

Drop a file here, click to choose one,or paste it from the clipboard (Ctrl + V)

Any file type, up to 10 MB

Both directions, text and files

Auto-detects the direction • UTF-8 and emoji safe • Base64URL & JWT • Base64 to image, PDF, or file • Image to data URI • Nothing leaves your browser

What Base64 is

Base64 is a way to write any binary data — an image, a PDF, a key — using just 64 safe text characters: A–Z, a–z, 0–9, plus + and /. It exists because plenty of systems can only carry text reliably: email, JSON, HTML, URLs. Encode a file as Base64 and it becomes an ordinary string that survives any of them, then decodes back into exactly the same bytes on the other side.

What Base64 is not matters just as much: it isn’t encryption, and it isn’t compression. It hides nothing — anyone can decode it — and the output is a third bigger than the input. Think of it as a shipping box for data in a text-only world.

How Base64 encoding works

The encoder takes the input three bytes at a time (3 × 8 = 24 bits) and splits them into four 6-bit groups. Each group is a number from 0 to 63, and each number maps to one character of the alphabet below. When the data doesn’t divide evenly into threes, the output is padded with = so its length is a multiple of four — which is why so many Base64 strings end in one or two equals signs.

That 3-to-4 ratio also explains the size: Base64 is about 33% larger than the original. A 3 MB photo becomes roughly 4 MB of text — one reason data URIs are best kept for small files.

The Base64 alphabet

6-bit value → character (RFC 4648):

ValueCharValueCharValueCharValueChar
0A16Q32g48w
1B17R33h49x
2C18S34i50y
3D19T35j51z
4E20U36k520
5F21V37l531
6G22W38m542
7H23X39n553
8I24Y40o564
9J25Z41p575
10K26a42q586
11L27b43r597
12M28c44s608
13N29d45t619
14O30e46u62+
15P31f47v63/

Base64 to image, PDF, or any file

Not every Base64 string hides text. When the decoded bytes aren’t readable text, the tool identifies the file from its first bytes — its “magic number” — and offers it as a download with the right extension: PNG, JPEG, GIF, WebP, AVIF, and HEIC images, PDF documents, ZIP, GZIP, 7-Zip, and RAR archives, MP3, WAV, OGG, and MP4 media, and WOFF, TTF, and OTF fonts. Images get a preview, and PDFs open in a new tab. Data URIs work too: paste data:image/png;base64,… as it is, prefix and all.

Going the other way, the File to Base64 card turns any file into plain Base64 — and images into a data URI, a ready-made <img> tag, or a CSS url() you can paste straight into your code. Inlining small icons this way saves an extra request per image.

Base64URL and JWTs

The + and / characters cause trouble in URLs and file names, so Base64URL swaps them for - and _ and usually drops the = padding. You’ll meet it in links, and above all in JSON Web Tokens: a JWT is three Base64URL parts joined by dots — header, payload, and signature. Paste a whole token above and you get the header and payload as formatted JSON, along with when the token was issued and when it expires. The signature isn’t verified; decoding only shows what a token claims. To encode in the URL-safe variant, tick Base64URL.

Where you’ll run into Base64

  • Data URIs — small images, icons, and fonts embedded in HTML or CSS as data:image/png;base64,….
  • Email attachments — MIME sends every attachment as Base64, because mail protocols were built for plain text.
  • JWTs and API tokens — the header and payload of every JWT are Base64URL-encoded JSON.
  • Certificates and keys — everything between -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- is Base64. Paste a PEM block and you can download the binary DER data.
  • HTTP Basic auth — the header Authorization: Basic dXNlcjpwYXNz is just user:pass in Base64. Easy to decode, which is why it must only travel over HTTPS.
  • Kubernetes Secrets — values under data: are Base64-encoded, not encrypted.

Decoding Base64 from the command line

No browser at hand? These commands do the same job — every example decodes to (or encodes) Hello:

CommandWhat it does
echo 'SGVsbG8=' | base64 --decodeDecode on Linux or macOS
echo -n 'Hello' | base64Encode on Linux or macOS (without -n, you encode a trailing newline too: SGVsbG8K)
[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('SGVsbG8='))Decode in Windows PowerShell
certutil -decode input.txt output.binDecode a file in the Windows command prompt
python3 -c "import base64; print(base64.b64decode('SGVsbG8=').decode())"Decode in Python
node -e "console.log(Buffer.from('SGVsbG8=', 'base64').toString())"Decode in Node.js

Base64 is not encryption

It looks unreadable, but it protects nothing — decoding needs no password or key, and anyone who gets hold of the string can do it. A password “hidden” in Base64 is still a password in plain text. Protecting data takes encryption such as AES; storing passwords takes a proper hash.

There’s a second risk that online decoders tend to skip over: people paste access tokens, certificates, and internal data into them, and all of it goes to someone else’s server. This tool runs entirely in your browser — whatever you paste or drop here is never uploaded. Try it with Wi-Fi switched off.

Why other decoders show é and 👋

Base64 encodes bytes, not letters, so text has to become bytes first — today almost always as UTF-8. An accented é takes two bytes in UTF-8 and an emoji takes four. A careless decoder reads those bytes back one character each, and café turns into café, while 👋 becomes 👋. JavaScript’s own atob() and btoa() work that way: btoa() throws an error on anything outside Latin-1, and atob() returns raw bytes as characters. This tool encodes and decodes strictly in UTF-8, so Hello, world! 👋 comes back exactly as it went in.

Decoded a JSON payload? Explore it in the JSON formatter, or line up two versions in JSON Compare.

Base64 FAQ

Decoding, images and PDFs, JWTs, padding, and privacy.

How do I decode Base64?

Paste the Base64 string into the box above. The tool recognizes Base64 on its own and decodes it straight away — to text if the result is text, or to a downloadable file if it’s an image, a PDF, or other binary data. If it guesses the direction wrong, switch from Auto to Decode or Encode.

Is Base64 encryption?

No. Base64 is just another way of writing the same bytes, and anyone can decode it in a split second — no password or key involved. Never use it to protect passwords or personal data; that takes real encryption such as AES, or hashing for passwords.

How do I convert Base64 to an image or a PDF?

Paste the string — with or without the data:image/png;base64, prefix. The tool detects the file type from its first bytes, shows a preview for images, lets you open PDFs in a new tab, and downloads the file with the right extension: PNG, JPEG, GIF, WebP, AVIF, HEIC, PDF, ZIP, MP3, MP4, fonts, and more.

How do I convert an image to Base64?

Drop the image into the File to Base64 card, click to choose it, or paste a screenshot with Ctrl + V. Pick plain Base64, a data URI, a ready-made HTML img tag, or a CSS url() value, then copy it or download it as a text file. Keep it to small images — Base64 makes files about a third bigger.

Why is Base64 about 33% bigger than the original?

Base64 writes every 3 bytes of data as 4 text characters, so the output is always roughly a third larger. That’s the price of using only characters that survive any text channel — email, JSON, HTML, or a URL.

What does the = at the end mean?

It’s padding. Base64 works in groups of 3 bytes; when the last group is incomplete, the output gets one or two = signs so its length is a multiple of 4. Base64URL usually drops the padding — this decoder reads both forms.

Can I decode a JWT here?

Yes. Paste the whole token — the three parts separated by dots — and you get the header and the payload as formatted JSON, plus when the token was issued and when it expires. The signature isn’t verified: decoding shows what a token says, not whether it’s genuine.

Is it safe to paste tokens, keys, or files here?

Yes. Decoding and encoding run entirely in your browser — nothing you paste or drop is uploaded, stored, or logged, and the page works offline once loaded. That matters with Base64, which so often carries access tokens, certificates, and credentials.

Need random Base64 keys instead? The UUID generator also creates cryptographic hex and Base64 secrets.