Base64 Encoder / Decoder

Is Base64 a way to protect data?

No. It is an encoding with no key, and anyone can reverse it, including with this tool. The Basic authentication header, for instance, is just Base64 of "user:password" (RFC 7617), which is why it is only safe over HTTPS. Never treat a Base64 string as hidden or encrypted.

How are non-English characters encoded?

The text is first converted to UTF-8 bytes, and the bytes are then encoded. That follows what most APIs expect. "café ☕" is 9 bytes in UTF-8 and encodes to Y2Fmw6kg4piV. Decoding assumes UTF-8 as well, so Base64 made from text in another character set may not decode to readable text.

Why do I get "Valid Base64, but not UTF-8 text"?

The string decoded fine but the bytes are not text. Examples: iVBORw0KGgo= begins every PNG image, and a signature in a JWT is raw bytes. Base64 of Latin-1 text is another case: Y2Fm6Q== decodes to the bytes c, a, f and E9, where E9 is é in Latin-1 but invalid in UTF-8. This tool decodes text only, not files.

Does the decoder accept URL-safe Base64 and missing padding?

Yes. The URL-safe alphabet from RFC 4648 uses - and _ instead of + and /, and the decoder converts them. It also adds missing = padding, so SGVsbG8sIFdvcmxkIQ decodes the same as SGVsbG8sIFdvcmxkIQ==. Spaces and line breaks inside the string, such as the 76-character wrapped lines in email, are ignored. The encoder always writes the standard alphabet with padding.

Can I decode a JWT with this?

The first two dot-separated parts of a JWT (header and payload) are Base64URL-encoded JSON, so you can paste each one separately and read them. eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9 decodes to {"alg":"HS256","typ":"JWT"}. The third part is a binary signature and will give the not-UTF-8 message. Decoding does not verify the token.

Why is the encoded text longer than the input?

Every 3 input bytes become 4 output characters, so output length is 4 × ceil(bytes ÷ 3), roughly one third bigger, and short inputs grow more because of = padding. The size figure compares UTF-8 bytes, not characters, so accented text is measured fairly.

What makes decoding fail?

Characters outside the Base64 alphabets, such as * or !, or a length that cannot be valid (one extra character after complete 4-character groups). The tool names the problem rather than guessing. A trailing newline or space does not matter.