Base64 Encoder

Base64 exists to move binary or text data through channels that only handle a restricted character set. It is how HTTP basic authentication carries credentials, how a data URI embeds an image in CSS, how an email attachment is marked, and how JWT segments are written. In each case the encoded form is safe to paste into a header, a URL or a JSON value without escaping.

It was not designed to be compact. Encoding always produces about a third more characters than the input, and the padding you see at the end of a result is not corruption: it marks the final group so the length is a multiple of four, which is how a decoder knows where the data ends.

There is no key and there is no secret. Anyone can decode a Base64 string as easily as you just did, so it provides no confidentiality whatsoever. Treating it as protection is one of the most common security mistakes made with configuration files and credentials.

It does buy one thing: a string that looks opaque is not casually readable or searchable. That is a small obstacle to accident and shoulder surfing, and nothing more. For an actual secret use a password hash, an encryption key or a secret manager.

Base64 operates on bytes, not characters, and the number of bytes is not the number you see. An accented letter or an emoji takes several bytes in UTF-8, so encoding always uses more input bytes than the character count suggests. Both figures are reported alongside the output so an unexpected result is easy to explain.

Decoding checks that the bytes are valid UTF-8 text. When they are not, the result is usually a file or image that was encoded rather than a string, and the tool says so instead of printing replacement characters you cannot interpret. A decoded value that is one unbroken token is flagged as likely secret material.

Command line tools wrap long output. base64 on a modern system inserts a line break every 76 characters, and OpenSSL certificate output is wrapped too, which is why a PEM key is a multi-line document. Copying that output as-is gives a string with newlines in the middle.

Decoding here removes all whitespace first, so wrapped output pastes directly. What is still rejected is a genuinely malformed value: characters outside the alphabet, or a length that is not a multiple of four once the line breaks are gone, both of which mean the string was truncated or was never Base64 to begin with.

Encoding and decoding are arithmetic on a string, so there is nothing to send to a server. This tool performs both operations in your browser: the value you paste is never uploaded, logged or stored, and there is no account involved.

That property is worth more than usual for this particular tool. A Base64 encoder is frequently pointed at API keys, connection strings and tokens precisely because the next step needs them encoded, which makes it one of the worst places to introduce an upload.