reckonist

Developer

Encoders, converters & dev utilities

12 tools
Developer · United States

Base64 Converter

Encode & decode Base64 — text, hex, PDF & images, URL-safe. In your browser. Accurate, instant and free — for United States.

Base64 is encoding, not encryption

Base64 is fully reversible — anyone can decode it, so it provides no confidentiality whatsoever. Never use it to “hide” secrets, tokens or credentials. To protect data, encrypt it.

100% in-browser — nothing is uploaded

Text, files and Base64 strings are encoded and decoded entirely in your browser — nothing is sent to a server. Files you upload never leave your device.
Mode
Base64 output
Encoded Base64 appears here.

Standard vs URL-safe, and where Base64 shows up

Standard Base64 (RFC 4648 §4) uses the alphabet A–Z a–z 0–9 + / with = padding. The URL-safe variant (§5) swaps +/ for -_ and usually drops padding — that's the form used inside a JWT. Need structured data instead? Try the Data-Format Converter, or checksum bytes with the Hash Generator.
Overview

Three bytes in, four characters out

Base64 turns arbitrary binary data into a string of 64 printable characters so it can travel through text-only channels — JSON, URLs, HTML data: URIs, email. It reads three bytes (24 bits) at a time and re-groups them into four 6-bit values, each mapped to one alphabet character. Output is ~33% larger than the input.

The alphabet

RFC 4648 §4

  • A–Z a–z 0–9 = 62 chars
  • plus + and / = 64
  • padded to ×4 with =

Padding

Keeps length a multiple of 4

  • 3 bytes → 4 chars, no pad
  • 2 bytes → 3 chars + =
  • 1 byte → 2 chars + ==

Decode targets

One engine, many outputs

  • Text (UTF-8) & hex bytes
  • PDF & image preview + download
  • Correct MIME on the Blob
Worked example — encode "Man"
Input
"Man" → bytes 4D 61 6E
Base64
TWFu
"M" (1 byte)
TQ==
"Ma" (2 bytes)
TWE=
Safety

Encoding is not encryption

This is the single most important thing to understand about Base64. It is a fully reversible transform with no key — anyone who sees the string can decode it in one step. Encoding a secret in Base64 is like writing it in a different alphabet: it hides nothing.

Never Base64 a secret to “protect” it

Base64 provides zero confidentiality. A token, password or API key that is only Base64-encoded is effectively in plain text. To protect data you must encrypt it with a real cipher and key. The only privacy this tool offers is that your input never leaves your browser — not that Base64 conceals anything.
Variants

Standard vs URL-safe, and decode targets

Standard (§4)

A–Z a–z 0–9 + /

Uses + and / and pads with =. The default for most APIs, email (MIME) and data URIs.

URL-safe (§5)

A–Z a–z 0–9 - _

Swaps +/ for -_ and usually drops padding, so it's safe inside a URL or filename. This is the base64url form used by JWTs.

Universal, spec-based — no per-region rules

Base64 follows RFC 4648 everywhere; there are no per-country variants. Decoding accepts either alphabet (this tool re-pads and normalises -_ back to +/ automatically), then renders your bytes as text, hex, a PDF or an image. Everything runs client-side; nothing is uploaded.
FAQ

Frequently asked questions

Base64 is a way to represent binary data using only 64 printable ASCII characters (A–Z, a–z, 0–9, plus + and /). It takes three bytes (24 bits) at a time and re-groups them into four 6-bit values, each mapped to one alphabet character — so the output is about 33% larger than the input. It exists so that binary data (images, files, encryption keys, email attachments) can travel safely through text-only channels like JSON, URLs, HTML data URIs and email headers.

No. Base64 is reversible encoding, not encryption. Anyone can decode a Base64 string instantly with no key — it provides zero confidentiality. Encoding a password, API key or token in Base64 does not protect it in any way; it is just a different spelling of the same secret. To actually protect data you must encrypt it with a real algorithm and key. Base64 only makes binary data text-safe; it never makes it private.

They use different characters for the last two alphabet slots. Standard Base64 (RFC 4648 §4) uses + and / and pads the output to a multiple of four with = characters. URL-safe Base64 (RFC 4648 §5) replaces + with - and / with _ so the string can sit inside a URL or filename without being escaped, and it usually omits the = padding. The two decode to identical bytes. JSON Web Tokens (JWTs) use the URL-safe, unpadded form (base64url). This tool can emit either and accepts both when decoding.

Paste the Base64 string, switch the mode to Decode, and choose PDF or Image as the target. The tool decodes the string to raw bytes, wraps them in a Blob with the correct MIME type (application/pdf or image/png), and shows an inline preview plus a download link. Everything happens in your browser — the encoded file is never uploaded. If the preview is blank, the Base64 simply is not a valid PDF or image; the decode itself still ran.

Base64 encodes in blocks of three input bytes to four output characters. When the input length is not a multiple of three, the final block is padded with one or two = characters so the output length stays a multiple of four: three bytes give four characters with no padding, two bytes give three characters plus one = (e.g. "Ma" → "TWE="), and one byte gives two characters plus two = (e.g. "M" → "TQ=="). URL-safe Base64 often drops the padding entirely, and a correct decoder can re-add it.

No. All encoding and decoding runs entirely in your browser using the native TextEncoder, atob/btoa and Blob APIs — nothing is sent to a server, logged or stored, and it works offline once loaded. That is the real privacy point: because people often paste encoded credentials, tokens or files, keeping the work client-side means those never leave your device. Remember that Base64 itself still offers no secrecy.

Sources

Standards & references

Method & assumptions Sources: RFC 4648 — The Base16, Base32, and Base64 Data Encodings · RFC 7515 — JSON Web Signature (base64url) Updated Jul 2026

Method: bytes are grouped three at a time and mapped to the RFC 4648 §4 alphabet (A–Z a–z 0–9 + /) with = padding; the URL-safe variant (§5) uses -_and drops padding. Encoding uses the browser's TextEncoder/btoa; decoding uses atob to raw bytes, then renders text, hex, or a MIME-typed Blob for PDF/image preview and download. Everything runs in your browser — no data is sent to a server.

How we calculate this

Reviewed by Reckonist Editorial · Last reviewed 4 July 2026. Figures follow the methods and sources set out in our editorial standards.

This tool encodes and decodes Base64 locally in your browser for developer convenience. Base64 is reversible encoding, not encryption — it provides no confidentiality. Never rely on it to protect secrets, tokens or credentials.

Keep going

Same-category tools follow this colour; a cross-category link keeps its own.