Base64 Encoder/Decoder

Yes. Unlimited use, no signup, no daily cap. Encoding and decoding run in your browser. Base64encode.org is free but ad-supported and ships your data to a server; we don't.

Standard Base64 uses A-Z, a-z, 0-9, +, /, and = padding. URL-safe (RFC 4648 §5) replaces + with - and / with _ so the result fits in URLs and JWT tokens without percent-encoding. Padding (=) is also usually dropped. We show both side-by-side.

Yes. Drop any file (image, PDF, archive) up to about 50MB and the tool reads its bytes via the FileReader API and produces the Base64 string. For images, the decode side will show a live preview.

When you decode Base64 that came from an image, we sniff the magic bytes (89 50 4E 47 for PNG, FF D8 FF for JPEG, etc.) and render it as a data: URL. Useful for debugging email attachments or data: URIs from CSS.

When decoded bytes aren't valid text (e.g. a zip or executable), the text preview shows replacement characters. The hex dump shows the actual byte values in 16-byte rows with offset and ASCII columns, like Unix's xxd. First 256 bytes shown for readability.

Up to about 50MB depending on browser memory. The btoa/atob primitives are fast but Chrome / Firefox cap the string length around 256MB. For genuinely large files, command-line base64 is faster, but we handle most use cases comfortably.

UTF-8 (default, modern web), Latin-1 (single-byte legacy), UTF-16 LE (Windows files). Toggle on the encode side; the decode side auto-falls-back. Most inputs are UTF-8 these days.

No. The encoder runs btoa() on UTF-8-encoded bytes. The decoder runs atob() on the input. Both are browser-native. There's no API call, no log, no telemetry. Even your file uploads stay local via FileReader.

Supported. Some old email standards wrap Base64 at 76 characters. We render that variant too. The decoder strips any whitespace before decoding so you can paste any of the three formats.

Yes for the visible parts. JWTs are three Base64URL-encoded strings joined by dots (header.payload.signature). Paste the whole token and we decode each segment. Note: signatures verify the contents but aren't human-readable; the header and payload are JSON.