Is Base64 a form of encryption?

No. Base64 is an encoding, not encryption. It is fully reversible by anyone with no key required. Never use it to protect passwords, tokens or any other secret.

What is URL-safe Base64?

Standard Base64 uses "+" and "/", which have special meaning in URLs. The URL-safe variant replaces them with "-" and "_" and usually drops the "=" padding, so the result can be placed in a URL or filename unchanged.

Why did my decode fail with valid-looking Base64?

Either the length is not a valid multiple of four after padding, the string contains characters outside the Base64 alphabet, or the decoded bytes are binary data rather than UTF-8 text. This tool decodes to text, so binary payloads will report an error.

Encoding & Conversion

Base64 Encoder and Decoder

Convert text to and from Base64. Unicode is handled correctly via UTF-8, and the URL-safe variant (RFC 4648 §5) is supported for tokens and query strings.

Plain text1 line

Encoded1 line

QnVpbGQuIExlYXJuLiBEZWJ1Zy4=

Base64 is an encoding, not encryption. Anyone can decode it. Never use it to protect secrets.

This tool runs entirely in your browser. Your input is never uploaded, stored or logged.

How it works

Base64 maps every three bytes of input onto four characters drawn from a 64-character alphabet, which is why encoded output is always about a third larger than its input. The "=" characters at the end are padding that indicates the original length was not a multiple of three.

Text has to become bytes before any of that can happen, and the encoding used matters. This tool converts to UTF-8 first, which is what makes non-ASCII input work. The browser built-in btoa does not: it assumes every character fits in one byte and throws on anything above U+00FF, which is why encoding an accented word or an emoji fails in the console but works here.

Decoding reverses both steps, and the second can fail independently of the first. A string can be perfectly valid Base64 and still decode to bytes that are not valid UTF-8 text — that happens whenever the original input was an image, a key, or any other binary payload. This tool reports that rather than returning replacement characters, because silently mangled output is harder to notice than an error.

Common problems

Every example below is run against this tool in our test suite, so what it says here is what the tool actually does.

Not valid base64

not valid!!

Why:: Characters outside the alphabet. Base64 uses A–Z, a–z, 0–9, + and /, with = for padding.
Fix:: Check for stray punctuation or a copied line break in the middle of the string.

The input length is incomplete

QQQQQ

Why:: Base64 encodes in four-character groups. A length that leaves a remainder of one cannot be a whole group.
Fix:: The string was truncated. Copy it again in full.

Decoded successfully, but the bytes are not valid UTF-8 text

//8=

Why:: Valid Base64 whose decoded bytes are binary rather than text. 0xFF is never a valid UTF-8 lead byte.
Fix:: The payload is binary — an image or a key, not a string. Decode it to a file instead.

Frequently asked questions

Is Base64 a form of encryption?: No. Base64 is an encoding, not encryption. It is fully reversible by anyone with no key required. Never use it to protect passwords, tokens or any other secret.
What is URL-safe Base64?: Standard Base64 uses "+" and "/", which have special meaning in URLs. The URL-safe variant replaces them with "-" and "_" and usually drops the "=" padding, so the result can be placed in a URL or filename unchanged.
Why did my decode fail with valid-looking Base64?: Either the length is not a valid multiple of four after padding, the string contains characters outside the Base64 alphabet, or the decoded bytes are binary data rather than UTF-8 text. This tool decodes to text, so binary payloads will report an error.

Last updated 20 September 2026