Base64 Encode / Decode

Encoding is not encryption

Worth saying plainly because the mix-up is everywhere: Base64 is an encoding, not a cipher. It transforms bytes into a transport-safe alphabet of sixty-four characters, and anyone can reverse it instantly — there is no key and no secret. Never treat a Base64 string as protected data. Credentials inside HTTP Basic auth headers, for example, are merely encoded; only the TLS layer around the request actually secures them. If someone hands you secrets hidden in Base64, decoding takes seconds — use it for representation, never for confidentiality.

Where Base64 shows up

Once you start looking, encoded strings appear constantly across everyday development:

• Data URLs embedding small images or fonts directly inside CSS, HTML, or JSON.
• HTTP Basic auth headers carrying username and password pairs.
• Email attachments, which MIME transports as Base64 text.
• JSON Web Tokens, whose segments use the URL-safe Base64URL variant.
• Encoded blobs buried in config files and logs that need reading before debugging.

Padding and the equals signs

Base64 output always comes in multiples of four characters, because every group of three input bytes becomes exactly four output characters. When the input does not divide evenly, the encoder pads the end with equals signs — one or two at most. Those '=' characters are part of the format under RFC 4648, so do not trim them off before storing or transmitting the string. A side effect worth remembering: encoded output runs roughly a third larger than the original bytes. On the decode side, surrounding whitespace and line breaks from wrapped emails or log files are tolerated — this tool trims them before parsing, so copied values convert cleanly even when the source mangled the formatting.

Why Unicode trips up naive converters

The browser's legacy btoa function only understands single-byte characters, so calling it directly on emoji or Hindi text either throws or silently corrupts the data. This tool routes input through proper UTF-8 encoding first — converting the string to bytes before the Base64 step — and mirrors the process with a matching decoder on the way back. That is why strings containing emojis or international scripts survive the round trip intact here while quick console one-liners frequently produce garbage.