CalConverters

Base64 Encoder / Decoder

Paste text and see it encode or decode as you type, or drop a file and let it stream. The work happens in your browser, so nothing you convert ever leaves the device.

Files never leave your device

Options

Uses - and _ in place of + and / — the variant JWTs, URLs and JWKs use.

Base64 turns arbitrary bytes into 64 printable characters so they can travel through channels that only accept text: an email body, a JSON field, a YAML config, a URL. This page does that conversion in both directions, for a pasted string or for a file, without sending anything anywhere.

What the conversion actually costs

Base64 is not compression — it is the opposite. Every three bytes of input become four characters of output, so the result is four thirds the size of what went in, plus padding. A 3 MB image becomes about 4 MB of text. That overhead is the price of being able to put binary data somewhere only text is allowed, and it is worth knowing before you inline a large asset into a stylesheet.

InputOutputGrowth
3 bytes4 characters133%
1 KB1,368 characters133%
1 MB~1.37 MB133%

Text mode and file mode

Text mode converts as you type and is meant for the everyday case: a token segment you need to read, a config value, a short string. It is capped at 1 MB, which is a limit on what a text box can render smoothly rather than on the encoder.

File mode is for everything else. The file is read as a stream and converted piece by piece, which is why a large file does not lock up the tab: the work happens off the main thread and the page keeps responding while a progress bar moves. You get a preview of the first part of the result and a Download button for the whole of it.

Tip: If you are only trying to read a JWT, paste just one segment — the part between two dots — and turn on the URL-safe alphabet. Tokens are not padded, which is fine: the decoder accepts missing padding.

Standard versus URL-safe

The two alphabets differ in exactly two characters, the ones at positions 62 and 63:

PositionStandardURL-safe
62plushyphen
63slashunderscore

Everything else is identical, so a value that happens to contain neither is the same in both. That is what makes the mismatch so easy to miss: a short string encodes identically under both alphabets and a longer one silently does not. When decoding, this tool accepts both without being told which is which, so a token pasted from anywhere just works.

Padding

The equals signs at the end are not data. Base64 emits four characters per three input bytes, and when the input does not divide evenly the last group is short:

  • f (1 byte) becomes Zg==
  • fo (2 bytes) becomes Zm8=
  • foo (3 bytes) becomes Zm9v, with nothing to pad

Some systems require the padding, others reject it, and JWTs omit it entirely. The toggle controls what gets written; the decoder does not care either way.

Data URIs

Turning on the data URI option while encoding a file wraps the result with the prefix a browser needs to treat it as an inline resource, and fills in the file type for you. The result can be pasted directly into a CSS background-image or an HTML img tag. Decoding is symmetric: paste a whole data URI and the prefix is recognised and stripped before the payload is decoded.

Inlining is a real trade-off. It removes a network request, which is why small icons are often inlined, but it also grows the file that carries it by a third and it cannot be cached separately. Below a few kilobytes it usually wins; above that it usually does not.

When decoding fails

Two things can go wrong, and the tool distinguishes them:

  • An invalid character. Something in the input is not part of either alphabet. The position is reported so you can look straight at it — most often a stray quote, an ellipsis from a word processor, or a fragment of the surrounding JSON that got selected along with the value.
  • A length that cannot work. Base64 is only valid at certain lengths, and one of the remainders is impossible. This nearly always means the value was truncated in transit.

Frequently asked questions

Is my text or file uploaded to a server?
No. Both the text box and the file mode run entirely inside your browser tab — the encoding happens in JavaScript on your own machine and no request carries your data anywhere. You can confirm it by opening your browser's network panel and converting something: there are no requests at all. This is the reason to use this page for a private key, a customer export or an unreleased asset.
How large a file can I convert?
File mode reads the file as a stream and converts it a piece at a time, so it is not limited by the size of a single chunk of memory the way a paste-only tool is. In practice the ceiling is your device's available memory, because the finished result is held until you press Download. Text mode is deliberately capped at 1 MB — that limit is about what a text box can render smoothly, not about what the encoder can handle.
What is URL-safe Base64 and when do I need it?
Standard Base64 uses the characters plus and slash, both of which have their own meaning inside a URL and get percent-escaped when you put them in one. The URL-safe alphabet swaps them for hyphen and underscore so the value survives being pasted into a query string or a path. JSON Web Tokens, JSON Web Keys and most modern APIs use the URL-safe form, so if you are decoding a token segment you want that toggle on.
Why does the output end in one or two equals signs?
Base64 works on groups of three bytes, and every group becomes exactly four characters. When the input length is not a multiple of three, the last group is short and the equals signs pad the output back out to a multiple of four. They carry no data. Turning padding off is safe for anything that measures the value itself, and many APIs prefer it — this decoder accepts both forms whatever the toggle says.
The decoder says my input is truncated. What does that mean?
Base64 can only be 4n, 4n+2 or 4n+3 characters long once whitespace and padding are removed. A length of 4n+1 leaves a single six-bit group with nowhere to go, which means characters went missing — usually a copy that stopped short or a line that got cut. The message reports the exact count so you can compare it against the source.
Can I decode a data URI directly?
Yes. Paste the whole thing, prefix and all, and the leading data marker up to the first comma is recognised and dropped before decoding. It also works the other direction: encode a file with the data URI option on and the result is ready to paste into a CSS background-image rule or an HTML img tag.
Does it handle Unicode correctly?
Yes. Text is converted to UTF-8 bytes before encoding, so accented Latin, Vietnamese tone marks, CJK and emoji all round-trip exactly. When decoding, the bytes are checked against UTF-8 strictly: if they are not valid text the tool says so and offers a download instead of filling the box with replacement characters that would silently corrupt a copy-paste.