Base64 encoding explained (and when not to use it)

How it works

The encoder writes the input as UTF-8 bytes, then maps every three bytes to four characters from the Base64 alphabet, adding = padding at the end. Decoding reverses the mapping and reads the bytes back as UTF-8, which is why accented characters and emoji survive the round trip.

• Standard Base64 with padding. URL-safe Base64 is available from the JWT tool for tokens.

Why it matters

Binary data and JSON do not mix well, so most APIs that carry images, certificates or small files base64-encode them first. Knowing what the encoding does — and what it does not protect — prevents both corrupted transfers and false expectations about privacy.

A worked example

The text hello wörld becomes aGVsbG8gd8O2cmxk because the encoder writes UTF-8 bytes first. Decoding those same bytes restores the original characters, accents included, without any loss.

Common mistakes

• Treating Base64 as encryption — it is reversible by anyone.
• Forgetting padding, which some decoders reject.
• Decoding a URL-safe token without translating - and _ back to + and /.

Practical tips

If the decoded output looks like mojibake, the bytes were probably not UTF-8; decode as Latin-1 to inspect them. For URLs, switch to the URL-safe alphabet so + and / do not need extra escaping.

How to use it

1. Open the tool. Everything runs in your browser tab.
2. Paste or type your input, then choose the action you need.
3. Check the result and copy it with one click.

Open the tool

Common questions