UltKit

Base64 Encode & Decode

Turn text or a file into Base64, or decode Base64 back to readable text. Unicode is handled correctly, the URL-safe alphabet is one click away, and decoding accepts either alphabet with or without padding.

Mode

0 characters · 0 words · 0 lines

0 characters · 0 words · 0 lines

Runs entirely in this browser tab. Your text is never uploaded or stored.

The Base64 alphabet

Index → character from RFC 4648. The highlighted last two differ in the URL-safe variant: 62 is + or -, 63 is / or _.

  1. 0A
  2. 1B
  3. 2C
  4. 3D
  5. 4E
  6. 5F
  7. 6G
  8. 7H
  9. 8I
  10. 9J
  11. 10K
  12. 11L
  13. 12M
  14. 13N
  15. 14O
  16. 15P
  17. 16Q
  18. 17R
  19. 18S
  20. 19T
  21. 20U
  22. 21V
  23. 22W
  24. 23X
  25. 24Y
  26. 25Z
  27. 26a
  28. 27b
  29. 28c
  30. 29d
  31. 30e
  32. 31f
  33. 32g
  34. 33h
  35. 34i
  36. 35j
  37. 36k
  38. 37l
  39. 38m
  40. 39n
  41. 40o
  42. 41p
  43. 42q
  44. 43r
  45. 44s
  46. 45t
  47. 46u
  48. 47v
  49. 48w
  50. 49x
  51. 50y
  52. 51z
  53. 520
  54. 531
  55. 542
  56. 553
  57. 564
  58. 575
  59. 586
  60. 597
  61. 608
  62. 619
  63. 62+ -
  64. 63/ _

How long the output gets

Every 3 input bytes become 4 characters; a final group of 1 or 2 bytes is padded with = in standard Base64 and left unpadded in the URL-safe form.

InputBytesStandardURL-safeLength
U1VQ==VQ4
Ul2VWw=VWw4
Ult3VWx0VWx04
UltK4VWx0Sw==VWx0Sw8
UltKi5VWx0S2k=VWx0S2k8
UltKit6VWx0S2l0VWx0S2l08

What Base64 does

Base64, defined in RFC 4648, writes arbitrary bytes using 64 printable ASCII characters: A–Z, a–z, 0–9, + and /. Every group of three bytes (24 bits) is split into four 6-bit numbers, and each number picks one character from the alphabet. When the input length is not a multiple of three, the final group is padded with one or two = signs. The result is always about 33% larger than the input: 4 characters for every 3 bytes.

It exists because many channels were built for text. Email (MIME), data: URLs in HTML and CSS, JSON fields that carry images or certificates, and HTTP Basic authentication headers all use Base64 to move binary data safely. It is not encryption and hides nothing; decoding needs no key.

Unicode and the URL-safe variant

Base64 encodes bytes, not letters, so text must first be turned into bytes. This tool always uses UTF-8, the encoding the web runs on: é becomes two bytes and an emoji four. The browser's built-in btoa function alone throws an error on any character above U+00FF, which is why naive encoders fail on accents and emoji; here the text goes through TextEncoder first, and decoding reverses it with TextDecoder. If decoded bytes are not valid UTF-8 (an image, a zip file), the tool shows them as hexadecimal instead of garbled text.

Standard Base64 uses + and /, which have meanings in URLs and file names. The URL-safe alphabet from section 5 of RFC 4648 replaces them with - and _, and padding is usually dropped. JSON Web Tokens use exactly this form. The decoder accepts both alphabets and missing padding, so you can paste either.

Encoding files and images

Choose a file and the tool reads it locally with FileReader and returns its Base64, or a complete data: URL with the file's MIME type ready to paste into an img tag or a CSS background. Inline images save an HTTP request but grow by a third and cannot be cached separately, so they suit small icons rather than photos. For images with a preview and ready-made HTML and CSS snippets, use Image to Base64.

Frequently asked questions

Why is the Base64 output longer than my input?
Each 3 bytes become 4 characters, so output is about 4/3 the size of the input, plus up to two padding characters. Non-ASCII text is longer still, because UTF-8 uses two to four bytes per character.
What are the = signs at the end?
Padding. They make the output length a multiple of four when the input length is not a multiple of three. One = means the last group had two bytes, two = mean it had one byte.
Why does decoding fail with an invalid character error?
The input contains something outside the alphabet, such as a space inside a word, a quote, or a % from URL encoding. Line breaks and missing padding are tolerated; other characters are not.
Is it safe to Base64-encode a password?
Base64 offers no protection. HTTP Basic authentication sends user:password in Base64, which is why it must only be used over HTTPS. Use real encryption or hashing to protect secrets.
What is the difference between Base64 and Base64url?
Only two characters and the padding: Base64url uses - and _ instead of + and / and usually omits =, so the result can sit in URLs and file names without escaping.