Base64 Encode / Decode
Convert text, files and images to and from Base64, live. It handles full UTF-8 (emoji and accented characters round-trip correctly), both the standard and URL-safe alphabets, and data:…;base64, URIs — decode a Base64 image to a preview, or encode a file to a string. Everything runs in your browser; nothing is uploaded.
Encoded/decoded entirely in your browser — nothing is uploaded. Safe for pasting a suspicious Base64 payload from a phishing email, a JWT, or a malware sample to inspect it offline, without ever sending it to a server.
What this tool is
- A free, in-browser Base64 encoder and decoder for text, files and images — paste or type on one side, the conversion appears live on the other.
- Full UTF-8 support: emoji and non-ASCII characters round-trip correctly, because it encodes the real bytes (not the Latin-1-only btoa/atob).
- Handles both the standard (+/) and URL-safe (-_) alphabets, with optional padding, and understands data:…;base64, URIs.
- File mode encodes any uploaded file to Base64, and decoding binary Base64 detects images (with a live preview) and offers the decoded file as a download.
- Everything runs client-side — nothing you paste or upload ever leaves your browser, which makes it safe for inspecting a suspicious payload offline.
What is Base64 and how does it work?
Base64 is a way to represent arbitrary binary data as plain ASCII text. Many systems — email, JSON, URLs, HTML — were built for text and will corrupt raw bytes, so Base64 gives you a text-safe stand-in. It is an encoding, not compression and not encryption: it adds no secrecy and actually makes data about 33% larger.
The mechanism is simple. Base64 reads the input three bytes (24 bits) at a time and slices those 24 bits into four 6-bit groups. Six bits can hold 64 values, and each value maps to one character from the alphabet A–Z a–z 0–9 + /. So three input bytes always become four output characters. When the input doesn't divide evenly by three, the final group is completed with one or two = padding characters so a decoder knows how many real bytes the last block held.
The URL-safe variant
The + and / characters are awkward inside URLs and filenames, so URL-safe Base64 swaps them for - and _ and usually drops the = padding. This is the flavour you'll find inside JSON Web Tokens (JWTs) and many API tokens. Toggle "URL-safe" to emit it; decoding accepts either alphabet automatically.
Where Base64 shows up in security
- JWTs & tokens. A JSON Web Token is three URL-safe Base64 segments (header, payload, signature) joined by dots. Decode the first two to read the claims — remember the signature still has to be verified; the decode alone proves nothing.
- Data URIs. Inline images and assets in HTML/CSS use
data:image/png;base64,…. Paste one here to see the image and extract the file. - Malware & phishing obfuscation. Droppers and macros often Base64-encode a PowerShell command or a second-stage payload to slip past shallow filters. Decoding offline — never on a production box — is a standard first triage step, and doing it client-side keeps the sample off any server.
- Email MIME. Attachments and non-ASCII message bodies are Base64-encoded for SMTP transport (MIME
Content-Transfer-Encoding: base64). - Basic Auth & CTFs. HTTP Basic credentials travel as Base64
user:pass— a reminder that Base64 is not a secret — and Base64 layers are a staple of capture-the-flag puzzles.
Security note: Base64 provides no confidentiality whatsoever. If you can read a Base64 string, so can anyone else — it is trivially reversible. Never use it to protect secrets; use real encryption for that.
Frequently asked questions
What is Base64?
Base64 is a binary-to-text encoding scheme that represents arbitrary binary data using 64 printable ASCII characters (A-Z, a-z, 0-9, and + and /). It works by taking three bytes (24 bits) of input at a time and splitting them into four 6-bit groups, each of which maps to one Base64 character; when the input length is not a multiple of three, the output is padded with one or two "=" characters. The result is text-safe data that can travel through systems that only handle text — email bodies, JSON, URLs, HTML data-URIs — without corruption. Base64 makes binary roughly 33% larger, which is the cost of that safety.
Is Base64 encryption?
No. Base64 is encoding, not encryption. It provides zero confidentiality: anyone can decode a Base64 string back to the original data instantly, with no key and no secret. It only changes the representation of data so it survives text-only channels. Treating Base64 as a way to "hide" a password, API key or token is a common and dangerous mistake — in security work, Base64 is frequently used by attackers to lightly obfuscate payloads, and decoding it (as this tool does) is a routine first step in analysing them, not a way to protect anything.
What is the difference between standard and URL-safe Base64?
Standard Base64 (RFC 4648 §4) uses + and / as its 62nd and 63rd characters and pads with =. Those three characters are reserved or problematic inside URLs and filenames, so URL-safe Base64 (RFC 4648 §5) substitutes - for + and _ for /, and padding is often stripped. URL-safe Base64 is what you see in JWTs, URL query parameters and many API tokens. This tool emits either alphabet via the "URL-safe" toggle and decodes both transparently, so you can paste a JWT segment or a standard string without choosing first.
Can I decode a Base64 image or file, and is my data private?
Yes. Paste a Base64 string (with or without a data:image/png;base64, prefix) and the tool detects the underlying file type from its magic bytes: images are shown as a live preview and any file can be downloaded. In the other direction, upload or drop a file and it is encoded to Base64. All of this happens entirely in your browser using JavaScript — the data is never sent to PlayCISO or any server. That local-only processing is exactly why it is appropriate for CTF challenges, malware triage and inspecting untrusted payloads offline.