Base64 Encoder and Decoder - URL-safe and UTF-8 Aware

Base64 solves one specific problem: moving arbitrary bytes through channels that were only built for text. Email headers, JSON fields, URLs, and CSS all expect printable characters, and raw binary dropped into them can be mangled by anything along the way that assumes text. Base64 takes any bytes and rewrites them using just 64 safe characters, the letters, the digits, and two symbols, so the data arrives intact on the far side. It is defined in RFC 4648, and it is why an image can live inside a stylesheet and a certificate can be pasted into a config file.

What it is emphatically not is a way to hide anything. There is no key and no secret involved; the transformation is fixed and public, so decoding is as easy as encoding, which is exactly why this tool can do it in one click. Seeing a long Base64 string can create a false sense that the contents are protected, and that misreading is a recurring source of security incidents. If the underlying data is sensitive, it needs real encryption; Base64 changes only how the bytes are written, never who can read them.

Base64 works on bytes, but text is not bytes until you choose an encoding, and that gap is where many converters quietly corrupt data. The browser’s built-in btoaonly accepts characters in the Latin-1 range, so feeding it an emoji or an accented letter directly either throws or mangles the result. The old workaround chained the deprecated escape and unescape functions, which mostly worked but is long deprecated and fragile.

This tool takes the modern route. Encoding runs your text through TextEncoder, which produces correct UTF-8 bytes for the full range of Unicode, and only then applies Base64. Decoding reverses it, turning the bytes back with TextDecoder in a strict mode that refuses invalid UTF-8 rather than inventing characters. The upshot is that an emoji, a line of Japanese, or a name with diacritics survives a round-trip exactly as you typed it.

All of this happens in your browser’s memory. There is no network request at any point, so a token, a credential, or any private string you paste never leaves your machine. Given how easily Base64 is decoded, that local guarantee is the meaningful privacy property here, not the encoding itself.

If the Base64 you decoded turns out to be a JWT, the JWT Decoder splits and decodes its three segments and shows the claims directly. For encoding characters in a URL rather than whole payloads, the URL Encoder / Decoder handles percent-encoding, and once you have decoded a JSON payload the JSON Formatter will beautify and validate it.