What Is Base64?
Base64 is an encoding scheme that converts arbitrary binary data into a 64-character text alphabet (A–Z, a–z, 0–9, "+", "/", and "=" for padding). It exists because many text-only protocols and storage formats — email bodies, URL query strings, JSON, XML, HTTP basic-auth headers, JWT tokens, certificate files — can't safely carry raw bytes without corruption. Base64 trades roughly a 33% size increase for the guarantee that the data will survive any ASCII-clean channel intact.
Developers use Base64 daily: embedding small images as data-URLs in CSS or HTML to skip an extra request, attaching files to API payloads, encoding API keys for Basic Auth headers, dropping certificates and private keys into config files, decoding JWT payloads to inspect claims during debugging, and converting between bytes and string forms when working with WebSockets, SSE, or service workers. The Tooldit encoder/decoder handles both text and binary files inside your browser so even sensitive payloads (API keys, certificates, tokens) never leave the device.
Base64 Encoder and Decoder for Text and Files
This Base64 encoder converts plain text or whole files into a compact string of safe ASCII characters, and decodes that string straight back to the original. Base64 exists because email systems, JSON payloads, HTML data URIs, and config files were built for text, not raw bytes — so anything binary has to be re-expressed in a handful of letters, digits, and symbols before it can travel through them. Instead of pasting your data into a random website that processes it on a server, this tool does the whole conversion inside your browser, so the content never leaves your machine.
It handles both directions in one place. Type or paste text to encode, drop in a Base64 blob to decode, or upload a file when you need a data URI for an image, font, or small asset.
How the Controls Work
Everything sits in a single panel above, and the output updates the instant you change the input or a setting:
- Encode / Decode toggle — switch between turning text into Base64 and reading Base64 back into text. The input label and placeholder change to match the mode so you always know what to paste.
- URL-safe checkbox — produces the URL- and filename-safe variant by replacing
+with-and/with_, and stripping the=padding. When decoding, it restores those characters and padding for you, so a token copied from a URL or a JWT decodes cleanly. - Swap — moves the current output into the input box and flips the mode, which is the fastest way to round-trip a value and confirm it encodes and decodes back to exactly what you started with.
- File— in Encode mode, reads the raw bytes of any file you choose and returns its Base64 representation; in Decode mode, it loads a file's text contents into the input.
- Copy — puts the result on your clipboard in one click, with a brief confirmation so you know it worked.
Why Use This Tool
- Runs entirely in your browser — your text and files are processed locally, never uploaded, so API keys and private data stay private.
- Completely free — no metered conversions, no "pro" tier hiding the URL-safe option behind a paywall.
- No sign-up — there is no account, no email gate, and nothing to install.
- No watermark or tampering — the output is the exact Base64 or decoded text, with nothing appended.
- Handles Unicode correctly — text is read as UTF-8, so emoji and accented characters survive a round trip intact.
Common Use Cases
- Inlining small assets — a US web developer encodes a tiny logo or SVG into a data URI so it ships inside the CSS instead of as a separate request.
- Inspecting a JWT — a backend engineer turns on URL-safe mode and decodes the payload segment of a JSON Web Token to check the claims during debugging.
- Reading config and secrets — a DevOps team member decodes a Base64-encoded value pulled from a Kubernetes Secret or an environment variable to verify it is correct.
- Pasting credentials into an API call — a developer encodes a
username:passwordstring for an HTTP Basic Authorization header before testing an endpoint.
Base64 Tool vs Other Tools
Versus command-line (base64, openssl) — base64 on Linux/macOS is great when you're already in a terminal, but flag differences (-w 0 on Linux, -i/-o on macOS) trip people up, and Windows doesn't ship it by default. The browser tool just works on any machine.
Versus inline-JavaScript (btoa, atob) — btoa and atob only handle Latin-1 strings; Unicode (e.g. emoji) throws an InvalidCharacterError. The Tooldit encoder handles UTF-8 and binary files correctly without the encodeURIComponent dance.
Versus other online encoders — many free Base64 sites paste your text or upload your file to a server before encoding. For API keys, tokens, or certificates, that's an instant security hole. Tooldit runs in your browser; the payload never leaves the device.
Versus a quick Python one-liner — base64.b64encode(open("f", "rb").read()) works but needs Python installed and a terminal. The web tool is one tab away in any browser.
Troubleshooting & Common Issues
- Decoded result is mojibake (??? characters) — the original was likely encoded as a different text encoding (Latin-1, Shift-JIS, etc.). The decoder assumes UTF-8 by default; if your source isn't UTF-8 you'll see replacement characters. Decode to bytes and inspect them in a hex viewer to spot the original encoding.
- Invalid Base64 input — valid Base64 uses A–Z, a–z, 0–9, +, /, and = padding. Some sources use URL-safe Base64 (- and _ instead of + and /). If decoding fails, try replacing - with + and _ with /.
- Encoded length isn't a multiple of 4 — valid Base64 strings are always a multiple of 4 characters, padded with = at the end. Missing padding makes decoders error out; manually append = until length is divisible by 4.
- Large file freezes the browser — encoding a 100 MB+ file allocates a 133 MB+ string and can stutter on low-memory devices. Split large files with a tool like split first, or use a streaming command-line encoder.
- Whitespace and line breaks in input — MIME-formatted Base64 wraps lines every 76 characters. Most decoders strip whitespace automatically; if yours doesn't, remove line breaks first.
- Data-URL prefix included by accident — a string like
data:image/png;base64,iVBORw0KG...isn't just Base64 — the prefix up to and including the comma is metadata. Strip it before decoding.
Frequently Asked Questions
+What is the difference between encoding and decoding here?
Encode takes ordinary text (or an uploaded file) and turns it into a Base64 string of safe ASCII characters. Decode does the reverse: it reads a Base64 string and reconstructs the original text. Use the Encode/Decode toggle at the top, or click Swap to move the current output back into the input and flip the mode in one step.
+When should I turn on URL-safe mode?
Turn on URL-safe mode when the Base64 needs to travel inside a URL, a query string, a filename, or a JWT segment. It swaps the standard plus and slash characters for hyphen and underscore and drops the trailing equals padding, so the string will not break routing or get mangled by a server. Leave it off for normal Base64 such as data URIs and email attachments.
+Can I encode an image or other binary file?
Yes. In Encode mode, click the File button and pick any file. The tool reads the raw bytes and produces the Base64 string, which is exactly what you need for a data URI or an inline asset. It reads the file in chunks so large files do not overflow the browser.
+Why do I get an "Invalid Base64 input" error?
Decoding fails when the input is not valid Base64 — for example it contains spaces, line breaks, or characters that are not part of the alphabet, or the length and padding are wrong. If your string uses hyphen and underscore instead of plus and slash, turn on URL-safe mode before decoding so the characters and padding are restored correctly.
+Is my text uploaded anywhere when I use this tool?
No. All encoding and decoding runs in your own browser tab using built-in JavaScript. Nothing you type, paste, or upload is sent to a Tooldit server, so secrets, tokens, and private files stay on your device.
+Is Base64 a form of encryption?
No. Base64 is encoding, not encryption. Anyone who receives the encoded string can decode it back to the original with no key. Don't use it to hide passwords or secrets — for security, use proper encryption (AES, RSA) or signed/hashed tokens (JWT, HMAC).
+What's the difference between standard and URL-safe Base64?
Standard Base64 uses + and / as the 63rd and 64th characters. Both are reserved in URLs and can cause ambiguity. URL-safe Base64 (used in JWTs and many REST APIs) substitutes - for + and _ for /, and often drops the trailing = padding. If a decoder rejects your input, try swapping these characters.
+Why does Base64 make my data bigger?
Base64 uses 6 bits per character versus 8 bits per byte in raw binary, so output is ~4/3 the size of the input — about 33% overhead. For a 3 MB file you get a ~4 MB encoded string. That's the trade-off for being able to carry the bytes through text-only channels.
Related Developer Tools
Working with encoded data often goes hand in hand with other developer utilities. Once you have decoded a payload, you might want to format and validate the JSON inside it, or use the hash generator to checksum a value. Browse the full set on the developer tools page.