Base64 is not encryption: what it does and when to use it

What Base64 does

Base64 writes arbitrary bytes using 64 safe text characters: the letters A–Z and a–z, the digits 0–9, and two symbols (+ and /), with = as padding. Every three bytes become four characters, so the encoded text is about one third larger. It exists so binary data can travel through systems built for text, such as email, JSON and URLs.

It does not hide anything. Anyone can decode Base64 in a second, without a key. If a value is only Base64-encoded, treat it as plain text.

Worked examples you can check

1. Open Base64 Encoder / Decoder, type Hello and select Encode. You should see SGVsbG8=. Paste that result and select Decode to get Hello back.
2. Encode é. The tool converts text to UTF-8 first, which gives two bytes for this character, so the result is w6k=, not a single-byte encoding.
3. Encode ???. Standard Base64 gives Pz8/. Turn on URL-safe encoding and you get Pz8_, because the URL-safe alphabet replaces + with - and / with _.

Input:     ???
Standard:  Pz8/
URL-safe:  Pz8_

Padding with = keeps the length a multiple of four. Some formats, including web tokens, leave it out; the tool has an option to omit it, and decoding accepts either alphabet.

Common mistakes

• Treating it as encryption. A secret that is only Base64-encoded is not protected. The readable sections of a signed JSON Web Token commonly use Base64URL. Decoding them does not verify the signature. Signature verification with a trusted key checks integrity; it does not encrypt the signed payload.
• Pasting a whole data URL. A value that starts with data:image/png;base64, includes a prefix that is not part of the Base64 data. This tool does not accept that prefix, so paste only the part after the comma.
• Mixing the two alphabets by hand. If the characters - or _ appear, the data is URL-safe. The tool decodes both, but other software may expect one specific alphabet.
• Decoding binary as text. Decoded bytes are not always valid UTF-8. When they are not, use the binary download rather than copying the text.

If you actually need protection or comparison

For confidentiality, use real encryption with a key managed by a tool built for that purpose. To check whether a file or message changed, use a hash. Hash Generator produces four checksums. MD5 and SHA-1 have known collision weaknesses, so prefer SHA-256 or SHA-512 where that matters. A hash is one-way, but short or guessable inputs can still be found by trying candidates, and passwords should be stored with dedicated password-hashing schemes rather than a plain checksum.

The encoding itself is defined in RFC 4648, which also describes the URL-safe alphabet.

Local processing and limits

The page loads its application files from this website, and your text is processed in your browser. The tool accepts up to 2 MiB of UTF-8 or decoded data. Invalid characters, misplaced padding and non-zero unused bits are rejected rather than silently repaired, so a rejected value usually means the input was truncated or copied with extra characters.