Security

Base64 Encoder

Encodes text as standard or URL-safe Base64, and is clear that this is encoding rather than encryption.

Loading the tool…

Processing happens locally in your browser. What you paste or load is processed by this page and is not uploaded to a server. Nothing is stored unless you use a control that says it stores something, and you can clear anything this site has kept from the privacy page.

How to use this tool

  1. Paste the text you want encoded.
  2. Choose URL-safe if the result is going into a path, a query string or a JWT segment.
  3. Select Encode, then copy the result.

What base64 encoder does

Base64 exists to carry arbitrary bytes through channels that only accept text — an email attachment, a JSON string, a data URI, an HTTP header. It represents three bytes as four printable characters, which is why the output is about a third larger than the input. That is the whole of what it does.

It is not encryption and provides no protection at all. Anyone who sees a Base64 string can decode it in a second, and treating it as a way to hide a credential in a configuration file or a URL is a mistake made regularly and expensively. The URL-safe variant swaps + and / for - and _ and drops the trailing padding, so the result can be used in a path or a query string without being escaped again.

Frequently asked questions

Not at all. It is encoding, not encryption — a transformation with no key that anybody can reverse instantly. Base64 in a config file or a URL hides nothing from anyone who looks. If a value needs protecting, it needs encryption or a secret store.

Whenever the result goes into a URL path, a query string, a filename or a JWT segment. Standard Base64 uses + and /, which have their own meaning in a URL and would have to be escaped again; the URL-safe variant uses - and _ instead and drops the = padding.

Because Base64 represents every three bytes as four printable characters, so the output is about 33% larger. That overhead is the price of moving arbitrary bytes through a channel that only accepts text, which is the only reason the format exists.