Z

Base64 Encode / Decode

Encode text to Base64 or decode Base64 back to text (UTF-8 safe), entirely in your browser.

Runs in your browser — files never leave your device

Input
Output

How it works

Switch between Encode and Decode, paste your text, and the result appears in the output box as you type — no button, no upload. Encode turns readable text into Base64; Decode turns Base64 back into text.

Encoding happens at the byte level: your text is first converted to UTF-8 bytes, and every group of 3 bytes is then mapped to 4 characters from the 64-character alphabet (A–Z, a–z, 0–9, + and /), with = padding the final group. That first step is what makes the tool Unicode-safe — emoji and accented characters become multi-byte UTF-8 sequences before encoding, where naive converters that feed the raw string to btoa simply throw an error. Decoding runs the same pipeline in reverse and interprets the resulting bytes as UTF-8 text.

A concrete example: Hello, world! is 13 bytes of UTF-8 and encodes to SGVsbG8sIHdvcmxkIQ== — 20 characters, including two = of padding. Unicode round-trips exactly: 👍 (4 bytes) encodes to 8J+RjQ== and decodes right back.

Base64 shows up wherever bytes must travel through text-only channels: values in .env files and Kubernetes secrets, HTTP Basic authentication headers, data: URIs, and awkward strings embedded in JSON or XML. One caveat matters more than all the others: Base64 is an encoding, not encryption. There is no key and no secrecy — anyone can reverse it instantly, with this very tool. Encode secrets to make them transport-safe, never to protect them.

Practical gotchas: output is about 33% larger than the input, since every 3 bytes become 4 characters. An invalid Base64 string decodes to empty output rather than an error — the usual cause is URL-safe Base64, the JWT variant that uses - and _ in place of + and /, which needs those two characters swapped back before decoding. And decoding bytes that aren’t text (an image, say) prints � replacement characters, because the result is interpreted as UTF-8 text.

Frequently asked questions

Is Base64 encryption?
No — Base64 is a reversible encoding with no key; anyone can decode it instantly, including with this tool. It exists to make arbitrary bytes safe to move through text-only channels, not to hide them. If you need confidentiality, encrypt first and Base64-encode the ciphertext.
What do the = signs at the end mean?
Base64 emits 4 output characters per 3 input bytes, and = pads the final group when the byte count is not a multiple of 3: one leftover byte produces ==, two produce a single =. That is why the 13-byte Hello, world! ends in ==. Padding carries no data, but standard decoders expect the total length to be a multiple of 4.
Why is my decode output empty?
Empty output means the input is not valid standard Base64 — it contains characters outside A–Z, a–z, 0–9, + and /, or has an impossible length. A frequent cause is URL-safe Base64 (used in JWTs), which swaps + for - and / for _; convert those characters back and decode again. Whitespace is not the problem — line-wrapped Base64 decodes normally.
Does it handle emoji and non-English text?
Yes. Text is converted to UTF-8 bytes before encoding, so any language and any emoji round-trips exactly — 👍 encodes to 8J+RjQ==. Simpler converters that feed the raw string straight to btoa throw an error on those characters; this tool encodes at the byte level instead.
How much bigger is Base64 output?
About 33% larger than the input: every 3 bytes become 4 characters, plus up to 2 characters of padding. The 13-byte Hello, world! becomes 20 characters. That overhead is the price of using only 64 universally safe characters.
Why does my decoded output show � characters?
The Base64 itself was valid, but the decoded bytes are not UTF-8 text — usually because the original data was binary, like an image or a compressed file. This tool interprets decoded bytes as text; binary payloads need a decoder that writes the bytes to a file instead.
Is my text uploaded?
No. Encoding and decoding run entirely in your browser as you type — nothing is uploaded, stored, or logged, and the logic matches the ZoolTools mobile app via shared test vectors.

Related tools