Base64 Encode & Decode Online
Convert plain text to Base64 or decode Base64 back to readable text. Useful for API payloads, Basic Auth headers, JWT segments, and debugging data transfers. Base64 is encoding, not encryption—it is reversible by anyone.
What is Base64 encoding?
Base64 is a way to represent binary data using only ASCII letters, digits, and a few symbols (+, /, with = padding). It is commonly used in HTTP Basic Authentication headers, JSON Web Tokens (JWT), email (MIME), and API payloads that must travel through text-only channels. CompareStack’s Base64 tool encodes plain text to Base64 or decodes Base64 back to readable output.
Important: Base64 is not encryption. Anyone can decode it. Do not treat Base64-encoded passwords or secrets as secure. Treat encoded values the same as plaintext in tickets, logs, and browser-based utilities.
How to use Base64 encode and decode
- Paste your text or Base64 string into the input field.
- Click Encode to Base64 to convert plain text into a Base64 string.
- Click Decode from Base64 to reverse a Base64 string back to text (or hex for binary data).
- Copy the result for your API client, script, or documentation.
- When debugging, round-trip a sample: encode, then decode, and confirm the output matches the original before shipping client code.
Worked example
Encoding the ASCII text user:demo produces a Base64 string suitable for illustrating Basic Auth shape (never use real
production credentials in examples). Decoding that string should return exactly user:demo. If decode fails, check padding
(= characters), truncated copy-paste, or URL-safe alphabets that use - and _ instead of
+ and /.
JWT payload segments use Base64url. If a JWT middle segment fails to decode here, translate URL-safe characters back to standard Base64 and restore padding, or inspect claims in a dedicated JWT workflow after redacting production tokens.
Common use cases
- Inspect the payload segment of a JWT during local debugging (after verifying it is not a live production secret)
- Build or verify HTTP Basic Auth credentials (
base64(username:password)) in non-production environments - Decode API responses that return Base64-encoded files or snippets
- Prepare small text blobs for inclusion in JSON or XML where binary is not allowed
- Document expected field shapes for support tickets without pasting live credentials
Decode tips and common errors
Valid Base64 uses characters A–Z, a–z, 0–9, +, and /, with = padding at the end when needed. Whitespace in pasted strings is ignored. If decoding fails, check for truncated copy-paste, URL-safe variants, or corrupted data. Double-encoding (encoding an already-encoded string) produces garbage that still “looks like” Base64—round-trip testing catches this early.
When decoded bytes are not valid UTF-8 text, CompareStack shows a hexadecimal view so you can still inspect binary content safely. Charset matters: Base64 represents bytes. If you encode UTF-8 text but interpret decode as Latin-1, accented characters break.
Security and session handling
Requests use HTTPS. Do not paste production passwords, private keys, or regulated personal data unless your organization permits online utilities. Prefer redacted samples. Read our Privacy Policy for cookies, logging, and advertising.
Related tools and guides
- URL Encode / Decode — percent-encoding for query strings
- JSON Formatter — validate API payloads that contain encoded fields
- Text Compare — diff encoded or decoded versions
- Base64 Encoding in APIs
Base64 in APIs and auth
Use encode for quick inspection of what goes into a Basic Auth header or binary-safe JSON field—then decode on the receiving side in your app.
JWT middle segments are Base64URL, which may differ slightly from standard Base64; translate - and _ if decode fails.
Never store passwords using only Base64; pair proper secret management with transport encryption (HTTPS).
Round-trip sample values (encode then decode) before shipping client code to catch padding and charset mistakes early.
Tool FAQ
Is Base64 the same as encryption?
No. Base64 is encoding—anyone can decode it. Do not use it alone to protect passwords or secrets.
What can I encode?
You can encode any text you paste into the tool. Very large inputs may take longer within the size limit on the page.
Why does decode fail?
Invalid characters, wrong padding, or truncated strings cause decode errors. Remove stray spaces and verify the full Base64 string was copied.
What is URL-safe Base64?
Some systems use - and _ instead of + and /. This tool uses standard Base64; translate characters if your API expects URL-safe variant.
Can I inspect JWT payloads here?
You can decode Base64url segments after translating characters and restoring padding, but never paste live production tokens without redaction.
What if decoded output is not readable text?
Non-UTF-8 bytes may show as hexadecimal so you can still inspect binary content safely.