What Base64 is for
Base64 turns any bytes into text using 64 safe characters: A–Z, a–z, 0–9, + and /. Every 3 bytes (24 bits) become 4 characters of 6 bits each, so the output is a third larger than the input. It exists because many channels, including email, JSON, XML, HTTP headers and URLs, can only carry text, and raw bytes would be corrupted or misread.
- Take 3 bytes: 24 bits.
- Split them into four 6-bit groups (values 0–63).
- Replace each group with its alphabet character.
- If the input length is not a multiple of 3, pad the last group with zero bits and append one or two
=signs.
hi is 0x68 0x69 = 01101000 01101001; regrouped as 011010 000110 1001(00) that is 26, 6, 36 → aGk, plus one = for the missing byte: aGk=.
Standard versus URL-safe
The characters + and / have special meaning in URLs and file names, so RFC 4648 §5 defines a second alphabet that uses - and _ instead, usually without padding. JWTs, OAuth tokens and many APIs use this “base64url” form. The decoder here accepts both, with or without padding, and ignores line breaks.
It is not encryption
Base64 hides nothing; anyone can decode it instantly. Use it to transport bytes, never to protect them. If you see a secret “encoded” in Base64 in a config file, treat it as plain text.
Text encoding
Base64 works on bytes, so text must be turned into bytes first. This tool uses UTF-8, which is what web APIs, JSON and nearly all modern software expect. A decoded result that is not valid UTF-8 is shown as hex instead of garbage.
Questions
Why does my Base64 end with = or ==?
Padding. The input length was not a multiple of 3 bytes, so the last block was filled out. One = means two bytes were in the last group; == means one. Many decoders accept input without padding, and the URL-safe variant usually omits it.
Is Base64 secure?
No. It is an encoding, not encryption; anyone can reverse it. It protects data from being mangled in transit, not from being read.
How much bigger does Base64 make a file?
About 33% (4 output bytes for every 3 input bytes), plus up to 3% more if lines are wrapped for MIME.
Why is my decoded text garbage?
Usually the data was not text at all (an image, a compressed blob), or the text was in a different encoding than UTF-8. Look at the hex view: a leading 89 50 4E 47 is a PNG, 1F 8B is gzip, 25 50 44 46 is a PDF.
What is a data: URL?
A URL that contains the file itself, e.g. data:image/png;base64,iVBOR… It lets you embed small images or fonts directly in HTML or CSS. The encoder gives you one when you drop a file.
Does this tool upload my file?
No. The file is read by JavaScript in your browser and never sent anywhere. Reload the page and it is gone.