Base64 Encode & Decode

Base64 represents binary data using 64 printable ASCII characters (A–Z, a–z, 0–9, + and /). Every 3 bytes of input become 4 characters of output, so encoded data is about 33% larger than the original, with = padding added when the input length is not a multiple of three. It is used wherever binary data has to travel through text-only channels: email attachments (MIME), JSON APIs, HTTP Basic authentication headers, JWTs and data URIs embedded in HTML or CSS.

Base64URL (RFC 4648 §5) replaces + and / with - and _ and usually drops the padding, so the result can be used in URLs, file names and JSON Web Tokens without further escaping. To read the header and claims of a token, paste it into the JWT decoder, which splits and decodes all three Base64URL parts at once. MIME Base64 (RFC 2045) wraps lines at 76 characters, which some email and PEM tooling still expects. This decoder accepts all of these variants automatically.

Text is encoded as UTF-8 first, so emoji and non-Latin scripts round-trip correctly, unlike the browser's built-in btoa() which fails on characters outside Latin-1. When decoding, the Base64 → File tab inspects the leading "magic bytes" to identify PNG, JPEG, GIF, WebP, PDF, ZIP and SVG content, lets you preview images and download the result with the right extension.

Base64 + gzip. Compressed data is often Base64-encoded so it can travel as text. Helm 3 stores each release in a Kubernetes Secret as Base64-encoded gzip of the release JSON (and Kubernetes Base64-encodes Secret data again), CloudWatch Logs subscription events arrive in Lambda as Base64-encoded gzip, the SAML HTTP-Redirect binding sends raw-DEFLATE-compressed, Base64-encoded messages, and gzipped files are sometimes kept in a ConfigMap's binaryData. This page recognises the gzip magic bytes 1f 8b and the zlib header (78 01, 78 9c, 78 da) and decompresses them with your browser's built-in DecompressionStream; raw deflate has no header, so pick it manually. Tick "Gzip before encoding" to produce the same kind of payload. To inspect SAML messages in full, use the SAML response analyzer.

Base64 is an encoding, not encryption: anyone can decode it, so never use it to hide secrets. Inlining small icons as data URIs can save HTTP requests, but for larger images the 33% overhead and lost caching usually make a separate file the better choice. Shrink an image with the image compressor or an SVG with the SVG optimizer before encoding it. Need HTML, JSON or JavaScript escaping instead? Use the String Escape & Unescape tool, and for query strings the URL encoder. Everything on this page runs locally in your browser.