Tool · Security

Base64 Encoder / Decoder

Encode text to Base64 or decode a Base64 string back to text. UTF-8 is handled correctly in both directions, so accented characters and non-Latin scripts survive the round trip. Everything happens in this browser tab.

Plain text

Base64 output

Output will appear here…

Encoding is not a security control

Base64 exists to carry arbitrary bytes through a channel that only accepts printable ASCII. There is no key, so there is nothing to attack — anyone who can read the string can read the content.

An Authorization: Basic header is cleartext credentials. It is the username and password joined by a colon and encoded, nothing more. That is why Basic auth is only acceptable inside TLS.
A Base64-encoded secret has not been protected. In a config file, a Kubernetes Secret or a CI variable it is only less greppable — and that cuts both ways, because a scanner looking for the secret itself will miss it.

When it will not decode, or decodes to nonsense

The string may be base64url, not Base64. This tool uses the standard RFC 4648 alphabet, ending in + and / with = padding. The URL-safe variant uses - and _ and usually drops the padding — which is what a JWT segment looks like. Use the JWT decoder, which does it for you.
Unreadable output does not mean the input was invalid. Decoding produces bytes, which this tool then reads as UTF-8. A PNG, a DER certificate or a gzip stream was still perfectly valid Base64.
It may be encoded more than once. Layered obfuscation — Base64 over gzip over more Base64 — is the normal shape of a malicious script. decoder-chains peels the layers in sequence and shows each stage.

Nothing you type here is transmitted. Both directions run as JavaScript in this tab, which matters because the strings people bring to a Base64 decoder are disproportionately credentials, tokens and captured headers.