Free tool Base64 decode and encode online
Paste a Base64 string to see what is inside it, encode text without the usual mojibake, or drop in an image to get a Data URI. Decoding tells you which character broke and whether the result is really text or a file.
- Text, images and files
- Explains broken input
- Runs locally, no upload
Decode or encode Base64
The sample is an analytics event packed as Base64, the way some tracking libraries put a JSON payload into a URL parameter. Switch the mode, paste your own string, or drop an image anywhere on this box.
Base64 to decode, or text to encode. A data:…;base64, prefix is recognised. You can also paste a screenshot here.
For encoding. Decoding accepts both alphabets on its own.
UTF-8 unless you know the system uses something else. GBK works for decoding only.
{"event":"sign_up","properties":{"plan":"pro","city":"München","utm_source":"newsletter"}}File found in the data
Recognised from the first bytes, not from a file name.
Raw bytes
91
Size of the data before encoding.
Base64 characters
124
Line breaks not counted.
Goes straight into src or url(). Always the standard alphabet with padding.
Shown for files up to 512 KB.
First 256 bytes: offset, bytes, printable ASCII (like xxd).
Checks
Version v1.0Updated Update history
What a Base64 string is telling you
Base64 carries bytes through places that only accept plain text: JSON, URLs, email, HTML attributes. Decoding gives back the bytes; what they mean depends on how they were made.
Standard or URL-safe
The two alphabets differ in two characters. Standard Base64 uses + and /, which have meanings in URLs; the URL-safe form (Base64URL) uses - and _ and usually drops the padding. JWTs always use the URL-safe form.
The = at the end
Every 3 bytes become 4 characters. When the data is not a multiple of 3 bytes, one or two = fill the last group. They carry no data, so many systems omit them.
A third bigger
Base64 output is about 4/3 of the input, plus line breaks if wrapped. A 30 KB image becomes about 40 KB of text, before gzip. That overhead is the price of fitting binary data into text.
Text or a file
The decoder looks at the first bytes. PNG, JPEG, GIF, WebP, SVG, PDF and ZIP are recognised and offered as a download; anything that is not valid text gets a hex view instead of garbled characters.
Base64 is an encoding, not encryption. Anyone can decode it with no key, so a token, password or personal data in Base64 is as readable as plain text.
Three ways to use it
Pick the mode that matches what you have in hand.
-
1
Decode a string
Paste the Base64. Line breaks, a missing
=and URL-safe characters are handled. If something is wrong, the message says which line and column. -
2
Encode text
Switch to encode and type. Choose URL-safe and turn off padding for URL parameters; turn on line breaks for MIME email bodies.
-
3
Turn an image into a Data URI
Choose a file, drop it on the box, or paste a screenshot. Copy the Data URI, or the ready-made
<img>and CSS snippet.
How 3 bytes become 4 characters
Base64 (RFC 4648) splits each group of 3 bytes, 24 bits, into four 6-bit values and writes each one as a character from a 64-character alphabet. The table uses the test vectors from section 10 of the RFC.
- Length with padding is 4 × ⌈n ÷ 3⌉ characters for n bytes
- MIME email wraps lines at 76 characters (RFC 2045); PEM keys and certificates at 64 (RFC 7468); URLs and JWTs never wrap
- In JavaScript,
btoa()only accepts characters up to U+00FF. Encode text to UTF-8 bytes first, which is what this tool does - Text encoding matters: the same word gives different Base64 in UTF-8, UTF-16 and GBK
| Input | Bytes | Base64 | Padding |
|---|---|---|---|
f | 1 | Zg== | 2 × = |
fo | 2 | Zm8= | 1 × = |
foo | 3 | Zm9v | none |
foob | 4 | Zm9vYg== | 2 × = |
fooba | 5 | Zm9vYmE= | 1 × = |
foobar | 6 | Zm9vYmFy | none |
Same text, different Base64
Base64 encodes bytes, so the result depends on how the text became bytes, and which alphabet was used. All values below were checked with Python’s base64 module.
| Input | Setting | Base64 | Why it differs |
|---|---|---|---|
München | UTF-8 | TcO8bmNoZW4= | ü is two bytes in UTF-8 (C3 BC) |
München | ISO-8859-1 | TfxuY2hlbg== | ü is one byte (FC); decoding this as UTF-8 fails |
中文 | UTF-8 | 5Lit5paH | Each Chinese character is three bytes |
中文 | UTF-16LE | LU6HZQ== | Two bytes per character, low byte first |
<<???>> | Standard | PDw/Pz8+Pg== | Contains / and +, which break inside a URL |
<<???>> | URL-safe | PDw_Pz8-Pg | - and _ instead, padding dropped |
When a system "decodes Base64 into garbage", the Base64 is usually fine and the text encoding is wrong. Try the other encodings in the dropdown before suspecting the data.
Where Base64 goes wrong
The encoding itself is simple. The trouble is almost always around it.
btoa() on non-English text
btoa("中文") throws an InvalidCharacterError, and Latin-1 tricks give results other systems cannot read. Convert to UTF-8 bytes first.
A + that became a space
Put standard Base64 into a query string without encoding it, and form decoding turns every + into a space. Use URL-safe Base64 or percent-encode the value.
Inlining large images
A Data URI is a third bigger than the file, cannot be cached separately and blocks the HTML or CSS it sits in. Keep it for small icons.
Treating it as a secret
Base64 hides nothing. API keys in a Basic auth header, a JWT payload or a "hidden" field are readable by anyone who sees them.
Send events as data, not as packed strings
Some setups squeeze event payloads into Base64 so they fit into a URL. With TapCub the script and SDKs send structured events, and the backend can send its own.
Server API
Payments, refunds or any backend job can send a named event with the project Server Key.
Learn moreValidated on arrival
Unexpected event names, missing properties and values of the wrong type are flagged instead of quietly skewing a report.
Learn moreSigned webhooks
Outgoing webhooks carry an HMAC-SHA256 signature and a timestamp; verify the signature before trusting the body.
Learn moreBase64 questions
Still have a question?
Chat with the team behind TapCub — we usually reply within a few hours on business days.
How do I decode a Base64 string?
Paste it into the box with the mode set to decode. Line breaks, a data:…;base64, prefix, missing = padding and the URL-safe characters - and _ are all handled. If the result is a file, such as an image, you get a preview and a download link instead of garbled text.
How do I convert an image to Base64?
Switch to "Image or file", then choose the file, drop it on the box or paste a screenshot. You get the plain Base64, a Data URI such as data:image/png;base64,…, and ready-to-paste <img> and CSS snippets. The file is read in your browser and never uploaded.
Why does my decoded text look garbled?
The bytes are usually right and the text encoding is not. Text made on an older Chinese system may be GBK; Windows tools often use UTF-16LE. Switch the text encoding and compare. If no encoding gives readable text, the data is probably binary, and the hex view shows its first bytes.
What is the difference between Base64 and Base64URL?
Base64URL (RFC 4648 section 5) replaces + with - and / with _ so the string is safe in URLs and file names, and usually drops the = padding. JWTs use it. Everything else is the same, and this tool decodes both.
Is Base64 a form of encryption?
No. It has no key and anyone can reverse it. It exists to move bytes through text-only channels. To protect data, encrypt it; to check data has not been changed, use a signature or a hash such as SHA-256 from the hash generator.
Why does btoa() throw an error on my text?
JavaScript’s btoa() only accepts characters up to U+00FF, so Chinese, emoji and many other characters throw "InvalidCharacterError". Encode the text to UTF-8 bytes with TextEncoder, then Base64 the bytes. This page does exactly that.
Is what I paste sent anywhere?
No. Decoding, encoding and file reading all happen in your browser. Nothing is uploaded, and this tool has no share link, so tokens or files you paste stay on your computer.
Update history
New features, fixes and data refreshes for this tool, newest first.
-
· v1.0
LaunchedFirst release.
Missing something or found an error? Tell us — requests that come up often go into the next update. All tool updates
Collect events without packing them into strings
One async script on the site, SDKs for apps and mini-programs, and a server API for everything that happens in your backend.