Base64 Encode / Decode
Pick Encode to turn text into Base64, or Decode to turn Base64 or base64url back into text, then press the button. The tool works on UTF-8 text, so accented letters, other scripts and emoji come through intact. Decoding skips spaces and line breaks and accepts a missing = at the end. The JWT tab decodes a JSON Web Token so you can read it, and does not verify its signature. The Image tab turns the Base64 of a picture back into the picture. All of it runs in your browser.
How to use the Base64 Encode / Decode
- Choose Encode, Decode, JWT or Image at the top.
- Type or paste your text, your Base64, your token or your data URL into the box.
- Press the button. Text appears in the Output box, with a link that copies it. A JWT shows its header and payload, and an image shows on the page with a Download link.
- In Encode and Decode, press Swap to move the output into the input and switch modes, for example to check that the text comes back unchanged.
The Base64 encoding process
Group input into 3-byte chunks (24 bits) → split into 4 × 6-bit groups → look up each in the Base64 alphabet
The Base64 alphabet has 64 characters: A–Z, a–z, 0–9, + and /. Each 6-bit group is one digit in base 64. When the input does not divide into whole 3-byte groups, = signs pad the end. Every 3 bytes become 4 characters, so the output runs about a third longer than the input. Base64url swaps + and / for - and _, so the result is safe in a URL, and usually drops the padding.
Worked example
"Hello" → "SGVsbG8=". The 5 bytes become 8 characters of Base64, including 1 padding character. "a" encodes to "YQ==" and "ab" to "YWI=". Decoding "TWFu" returns "Man". The text "é?" is "w6k/" in Base64 and "w6k_" in base64url, and both decode to "é?". The sample token in RFC 7519 shows the header {"typ": "JWT", "alg": "HS256"}, the issuer "joe", an expiry of 2011-03-22 18:43:00 UTC and a signature of 32 bytes.
Frequently asked questions
Is Base64 encryption?
No. It is encoding, and anyone can decode it. Base64 carries binary data through text-only protocols such as email and JSON, and it hides nothing.
Why do encoded strings end with =?
Base64 turns every 3 bytes into 4 characters. If 1 byte is left over at the end, the output ends with ==. If 2 bytes are left over, it ends with a single =. So "a" gives YQ== and "ab" gives YWI=. RFC 4648, the standard that defines Base64, sets these rules.
Where is Base64 used?
Email attachments (MIME) and data URLs in HTML and CSS (data:image/png;base64,...) use it to carry binary data as text. JSON Web Tokens use the URL-safe variant with - and _.
How do I decode base64url?
Paste it into Decode. The tool reads both alphabets, and a string that mixes + or / with - or _ gets a message. For the other direction, tick URL-safe in Encode, which writes - and _ and leaves out the padding, the way RFC 7515 defines base64url for tokens.
Is this JWT decoder safe to use?
The decoding happens in your browser and the tool sends the token nowhere. Even so, do not paste secrets or live production tokens into any web page, because a token can act as a login until it expires. It decodes only. It does not verify the signature, which takes the signing key, so a token that reads fine here can still be forged or altered. Never trust its contents because they decode. An encrypted token with five parts (JWE) gets a message, because it cannot be read without its key.
How do I turn Base64 into an image?
Paste the Base64, or a data URL that starts with data:image, into the Image tab. The tool reads the first bytes to find the type, so a wrong label does not matter. It shows PNG, JPEG, GIF, WebP, BMP, ICO, AVIF and SVG, as far as your browser can draw them, with a Download link. It does not send the image anywhere.