How to encode text to Base64
- Type or paste your text into the box above.
- Tick URL-safe if the result will travel in a URL or a filename.
- Tick line wrapping if the output is going into an email header or a PEM-style block.
- The encoded string appears immediately below.
- Copy it, or download it as a text file.
What this encoder handles
- Full Unicode, so accented characters, Greek, Cyrillic, CJK and emoji all encode correctly.
- A URL-safe variant that swaps plus and slash for hyphen and underscore and drops padding.
- Optional 76-character line wrapping for MIME and PEM contexts.
- A live readout of how much larger the encoded form is.
- Instant updates with no button to press.
- No upload, so tokens and configuration values stay on your machine.
What Base64 is for
Base64 exists because a great deal of infrastructure was built to carry text and nothing else. Email headers, URLs, XML attributes, JSON strings, HTTP headers and many database columns will mangle or reject arbitrary bytes. Base64 maps any data onto 64 characters that all of them handle safely, letters, digits, plus and slash.
The cost is size. Every three bytes become four characters, so the encoded form is about 33 per cent larger. That is the price of passing through systems that would otherwise corrupt the data.
Where you meet it
- HTTP Basic authentication headers, which are username and password Base64-encoded.
- JSON Web Tokens, whose three parts are each Base64URL.
- Data URIs embedding small images directly in CSS or HTML.
- Email attachments, which MIME encodes as Base64 with 76-character lines.
- Certificates and keys in PEM format, wrapped in BEGIN and END markers.
Unicode is where naive encoders fail
The browser's built-in btoa function only accepts characters below 256. Give it "café" and it throws an error; give it an emoji and it throws too. Plenty of online encoders simply break on non-English text as a result.
This encoder converts the text to UTF-8 bytes first, then encodes those bytes. That is the correct order and it means every script works. French accents, Greek, Cyrillic, Arabic, Japanese, emoji. Anything that decodes it must interpret the bytes as UTF-8, which every modern system does by default.
The URL-safe variant
Standard Base64 uses + and /, both of which have meaning in a URL. A plus sign is a space in a query string, a slash is a path separator. The URL-safe variant swaps them for - and _ and usually drops the = padding, which also has meaning in some contexts.
Use it for anything going into a URL path, a query parameter, a filename or a cookie. JSON Web Tokens use it, which is why a JWT contains hyphens and underscores rather than pluses and slashes.
Base64 is not encryption
This needs saying plainly, because it is misused constantly. Base64 is a reversible encoding with no key and no secret. Anyone who sees the string can decode it in one click, including with the decoder on this site. Encoding a password, an API key or personal data provides exactly zero protection.
It is obfuscation at best, and it frequently gives a false sense of security to people who have not thought about it. If data needs protecting, it needs encrypting. Everything here runs in your browser, so nothing you paste is transmitted anywhere.
Encoding is not compression either
Alongside the confusion with encryption, Base64 is sometimes reached for as though it makes data smaller. It does the opposite: the output is always about a third larger than the input, without exception, because four characters are used to carry every three bytes.
If size is the concern, compress first and encode afterwards, gzip the data, then Base64 the compressed bytes. Encoding first and compressing afterwards works far less well, because Base64 output has less redundancy for a compressor to exploit than the original binary did. The order matters more than people expect.