Skip to content
bobob

Base64 Encoder Decoder

Encode, decode, inspect, and copy a safe payload report for Base64, Base64URL, image data URLs, JSON payloads, and JWT segments locally in the browser.

Runs in your browserNothing you type is sent to a server.

Input and result

What you type is kept in this browser only. Reopen to restore your last run.

Use cases

  • Decode copied Base64 payloads from logs
  • Copy a Base64 payload report with variant, decoded shape, warnings, and safe handoff checks
  • Preview and download Base64 image data URLs before copying binary output
  • Convert text to Base64 for fixtures
  • Normalize URL-safe token segments before inspection
  • Spot and format JSON or secret-like decoded values before sharing

Examples

Common input
hello world
Encode plain text, decode Base64 transport values, inspect decoded shape, and copy a payload report.
Typical output
aGVsbG8gd29ybGQ=
Use this as a quick sanity check before copying results.
JSON transport value
eyJzdGF0dXMiOiJvayIsInNjb3BlIjoicmVhZCJ9
Detects JSON-shaped decoded output and prepares a compact payload report before sending it to JSON Formatter.
Image data URL
data:image/png;base64,iVBORw0KGgo=
Checks whether a copied image payload starts as a valid data URL.

Common mistakes

  • URL-safe Base64 and standard Base64 can differ by padding and character set.
  • Binary data may not round-trip as readable UTF-8 text.
  • A JWT payload segment can look like plain Base64 even though it needs token context.
  • Decoded output can expose credentials, cookies, or API keys hidden in transport values.

Before you copy

  1. 1Choose encode or decode mode deliberately before pasting the value.
  2. 2Confirm the decoded text is expected UTF-8, not binary or compressed data.
  3. 3Use the diagnostics panel to check JSON keys, JWT-like payloads, padding, and control characters.
  4. 4Redact secrets before using the result in bug reports or docs.

Sources

  • Standard Base64 and URL-safe Base64 use different alphabets

    RFC 4648 uses + and / for the 62nd and 63rd characters, while base64url uses - and _. Put standard Base64 in a URL, cookie or path and / reads as a path separator and + as a space.

    Basis: RFC 4648

  • JWT segments have no = padding

    JWS defines BASE64URL as base64url with all padding removed (RFC 7515). Feed a JWT segment to a standard Base64 decoder and it fails because the length is not a multiple of four.

    Basis: RFC 7515

  • Base64 is not encryption

    RFC 4648 defines Base64 as a data encoding - anyone can reverse it, no key involved. Wrapping a token or a secret in Base64 hides nothing; it only adds a step.

    Basis: RFC 4648

FAQ

Does Base64 Encoder Decoder upload my input?

No. This tool runs in your browser unless the privacy badge explicitly says a server route is required.

Can I use this for production secrets?

Avoid pasting sensitive production data into any website. Prefer local test data or redacted payloads.

Why does decoded Base64 look unreadable?

The decoded bytes may be binary, compressed, encrypted, or not UTF-8 text. Treat unreadable output as a signal, not a failure.

When should I use Base64URL mode?

Use Base64URL for JWT segments, URL-safe tokens, and values that replace plus and slash with URL-safe characters.