Is Base64 encryption?

No. Base64 is an encoding, not a cipher — anyone can decode it in one step, with no key. It exists to move binary data through channels that only accept text. Treat anything you have Base64-encoded as plaintext.

What is the difference between Base64 and Base64url?

The last two characters of the alphabet. Standard Base64 uses + and /, both of which have meaning inside a URL. Base64url substitutes - and _ and usually drops the = padding, which is why JWTs and OAuth parameters use it.

Why does btoa() fail on my string?

The browser's btoa() only handles Latin-1 and throws on any character above U+00FF, so accented text, CJK and emoji all break it. This tool converts to UTF-8 bytes first, so those round-trip correctly.

Base64 Encoder / Decoder

Convert text to and from Base64, including the URL-safe alphabet.

Text → Base64

Plain text

Type or paste text

UTF-8 is handled correctly

Base64

Output appears here.

Options

URL-safe alphabet (-, _)

Pad with =

Processed locally in your browser. Encoding and decoding happen in this tab. Base64 is not encryption — treat encoded secrets as plaintext.

Reference

What Base64 is for

Base64 maps arbitrary bytes onto 64 printable ASCII characters so they can travel through channels that only accept text — email bodies, JSON strings, data URIs, HTTP headers. Every three bytes become four characters, so encoded data is about 33% larger than the original.

It is an encoding, not a cipher. Anything you Base64 is readable by anyone who bothers to decode it.

Standard and URL-safe alphabets

The standard alphabet ends with + and /, both of which have meaning inside a URL. RFC 4648 defines a URL-safe variant that substitutes - and _; it is what JWTs, OAuth parameters and most filename-safe encodings use. Padding is usually dropped in that variant because = also needs escaping in a query string.

Position 62 / 63	Where you see it
+ /	Standard Base64: MIME, data URIs, HTTP Basic auth.
- _	URL-safe Base64: JWT segments, OAuth state, filenames.

Padding

= pads the final group to four characters. It carries no data — it only records how many bytes the last group holds. Decoders can infer that from the length, which is why unpadded input decodes fine here. What is not valid is a length that leaves one character over: Zm9vYmFyZ cannot be a whole number of bytes, and is reported as truncated.

UTF-8 and the btoa trap

The browser's btoa() operates on Latin-1 and throws on any character above U+00FF, which is why btoa("日本") fails. Text here is converted to UTF-8 bytes first, so accented characters, CJK and emoji all round-trip exactly.

Decoding can also produce bytes that are not valid UTF-8 at all — that happens when the input is a binary payload rather than text. The tool says so rather than silently substituting replacement characters.

Questions

Is Base64 encryption?: No. Base64 is an encoding, not a cipher — anyone can decode it in one step, with no key. It exists to move binary data through channels that only accept text. Treat anything you have Base64-encoded as plaintext.
What is the difference between Base64 and Base64url?: The last two characters of the alphabet. Standard Base64 uses + and /, both of which have meaning inside a URL. Base64url substitutes - and _ and usually drops the = padding, which is why JWTs and OAuth parameters use it.
Why does btoa() fail on my string?: The browser's btoa() only handles Latin-1 and throws on any character above U+00FF, so accented text, CJK and emoji all break it. This tool converts to UTF-8 bytes first, so those round-trip correctly.