⌘ K
text → base64 · URL-safe · UTF-8 · live

Encode text to Base64

Convert UTF-8 text to standard or URL-safe Base64. Works with emoji and any Unicode input. All processing runs locally.

Base64 Encoder
Input
60 B
2 lines
Output
96 B
1 lines
Status
ready
live
Ratio
1.60×
out/in
input · text
output · base64
SGVsbG8sIHdvcmxkIQpFbmNvZGUgYW55IFVURi04IHRleHQgw6LigqzigJ0gZW1vamkgw7DFuMWh4oKsIHdvcmsgdG9vLg==
Quick Start

How to encode Base64: a complete step-by-step guide

Base64 is the canonical text encoding for arbitrary bytes — defined in RFC 4648 and used everywhere from HTTP Basic Auth to data URIs to JWT segments. This encoder takes UTF-8 text, runs it through TextEncoder to get raw bytes, then maps each 3-byte group to 4 base64 alphabet characters via btoa. URL-safe mode applies the § 5 alternate alphabet for transport in URLs and headers.

  1. 01

    Type or paste UTF-8 text

    Drop in any Unicode string — ASCII, accented Latin, CJK ideographs, emoji, even mixed scripts. Native btoa() only accepts Latin-1, so we route everything through TextEncoder().encode() first to emit a faithful UTF-8 byte sequence before encoding.

    Need to encode a file (image, font, binary blob) instead of text? Use the Image to Base64 tool — it handles file readers and proper MIME prefixes for inline embedding.

    UTF-8TextEncoderUnicodeemojibtoa
    input · plain text1 line
    Hello, world!
    13 B · 13 charsutf-8 · ready
  2. 02

    Pick standard or URL-safe alphabet

    Standard Base64 (RFC 4648 § 4) uses A-Z a-z 0-9 + / with = padding. URL-safe Base64 (§ 5) substitutes - for + and _ for /, optionally dropping padding — so the encoded string survives unescaped in URLs, JWT segments, cookies, and HTTP headers.

    If your downstream consumer is HTTP Basic Auth or a MIME body, leave URL-safe off. If you're encoding a token for a query parameter or composing a JWT, turn it on.

    RFC 4648 § 5url-safepaddingJWT segmentalphabet
    alphabet · variantstandard
    + / =   →   - _   (no padding)
    alphabet setRFC 4648
  3. 03

    Watch the live encoded output

    The output panel updates on every keystroke — no submit, no debounce, no network. Each 3 input bytes expand to 4 output chars, giving a ~33% size overhead. Lengths not divisible by 3 are padded with = in standard mode; URL-safe mode drops the trailing pad.

    To round-trip the result back to text, paste it into the Base64 Decoder, which handles both alphabets automatically.

    live3:4 ratioRFC 4648 § 4client-sideround-trip
    output · base64+33% size
    SGVsbG8sIHdvcmxkIQ==
    20 B · 1 lineencoded · ready
  4. 04

    Copy, download, or chain into another tool

    Click Copy to send the result to your clipboard, or Download to save as .txt. The encoded string is ASCII-only and safe for any byte-clean transport.

    Common follow-ups: feed the output into data: URIs, build an Authorization: Basic header (btoa("user:pass")), or stitch base64url segments into a JWT with the JWT Encoder.

    clipboard.txtdata URIBasic authprivacy-first
    export · actions3 actions
    ✓ Copied to clipboard
✓ Saved: base64.txt
✓ 100% client-side
    ready to ship0 outbound
Pro tips

Encoding without surprises

Always UTF-8 first

Use TextEncoder / TextDecoder for bytes ↔ string conversion. btoa alone breaks on non-ASCII.

URL-safe vs standard Base64

Standard uses +, /, =; URL-safe swaps to -, _, no padding. Don’t mix them.

Hashes aren’t passwords

SHA-256 is fast; that’s good for fingerprints, bad for passwords. Use bcrypt / argon2 for credentials.

Watch padding rules

Some decoders are strict about = padding, others auto-pad. If round-trips fail at exactly 1 or 2 bytes, check padding.

Use Web Crypto for keys

Generate cryptographic keys via crypto.subtle, never Math.random. The latter is predictable.

JWT decode ≠ verify

Decoding a JWT just splits and base64-decodes. Verification needs the issuer’s public key / shared secret.

Related toolsBase64 DecoderImage to Base64URL EncoderText to HexHTML EncoderUnicode Converter
Use Cases

When to encode Base64

Auth tokens, data URIs, binary embedding.

Auth headers

HTTP Basic Auth uses Base64 of user:pass. Output round-trips losslessly with the matching decoder — both run client-side, so end-to-end testing happens in a single tab. Encoding flows through TextEncoder for predictable UTF-8 semantics.

RFC-compliant

Data URIs

Embed images/fonts inline in CSS/HTML. Web Crypto's subtle.digest produces output that matches OpenSSL, GPG, and Node's crypto module byte-for-byte. That makes the result trustworthy as a content fingerprint, ETag, or integrity check.

OpenSSL-matched

Email attachments

MIME parts wrap binary in Base64. Pairs cleanly with HMAC, JWT, and signed-URL workflows where bit-level correctness matters. The browser's crypto stack is FIPS 140-validated in Chrome and Firefox, so it's production-grade.

lossless

Token formats

JWT segments, OAuth state, CSRF nonces. Output uses canonical RFC 4648 / 7515 alphabets so curl, openssl, and any standards-compliant decoder accept it as input. URL-safe variants drop padding for tokens that travel in query strings.

byte-identical

URL params

URL-safe mode for tokens passed in query strings. Heavy hashing runs through useMemo so large inputs don't block typing. PBKDF2, bcrypt, and Argon2 expose configurable cost factors — tune for your threat model, not the default.

spec-grade

Binary in JSON

Send bytes through JSON-only APIs. Same input plus same options always yields identical bytes. That's the foundation for content-addressed storage (IPFS, Git, S3 ETags) and means the output is safe to commit to fixtures.

production-ready
FAQ

Frequently asked questions

Standard Base64 uses + / =. URL-safe replaces them with - _ and drops trailing = so the output works inside URLs without escaping.
btoa() expects Latin-1 only. We TextEncoder() to UTF-8 first so emoji and accented characters survive correctly.
Browser memory limits — typically megabytes work fine.
For files use Image to Base64 or paste contents as text first.
No. Encoding runs entirely in your browser.
Suggest a tool

Something missing?

Tell us what you need. We ship the top requests every two weeks.

Sent straight to the maintainers · no account needed
47 in queue·8 shipped this month
Request queued. Thanks!