Base64 is a way of writing any data using only 64 safe characters: the letters A to Z and a to z, the digits 0 to 9, plus and slash, with an equals sign sometimes added at the end as padding. It exists because a lot of old, still-used systems, email above all, were built to carry plain text and choke on arbitrary bytes. Turn the bytes into Base64 and they travel safely as text.
You meet it more often than you might think. The long string after data:image/png;base64, in a web page. The Authorization: Basic … header some APIs use, which is just username:password in Base64. The three dot-separated parts of a JWT login token. Email attachments. Cryptographic keys and certificates in PEM files.
Encoding and decoding
Type or paste text, choose Encode, and you get the Base64 version. “Hello, world!” becomes SGVsbG8sIHdvcmxkIQ==. Paste Base64 and choose Decode to read it. Both directions happen live as you type.
Text with accents, emoji or non-Latin scripts is handled correctly: the tool turns it into UTF-8 bytes first and encodes those, which is what everyone else does, so the result will match what other tools and programming languages produce. Decoding turns the bytes back into text the same way.
The decoder is forgiving. It ignores spaces and line breaks, which Base64 in emails and PEM files is wrapped with, and it accepts the URL-safe variant that uses - and _ in place of + and /. Missing padding is fine.
It is not encryption
This is the thing to take away. Base64 hides nothing. Anyone can decode it in a second, with a page like this one, so it must never be used to protect a password, a key or personal data. If someone tells you a secret is “encoded” in Base64, it is not secured. If you do need to lock text with a password, the protected text tool uses real encryption in your browser.
Base64 also makes data bigger, by about a third: every three bytes become four characters. That is the price for being text-safe, and why embedding large images in a web page as Base64 is usually a bad idea.
When decoding fails
If the tool says it cannot decode the input, check the likely culprits: the string has been cut off, it contains a character that is not in the Base64 alphabet, or it is not Base64 at all, just something that looks like it. A correct Base64 string has a length that works out, once padding is counted, to a multiple of four.
Related tools: for web addresses use the URL encoder, for characters like < and & in HTML use the HTML entities tool, and to see the raw bytes of text, try the hex translator or the binary translator. The older all-in-one text encoder and decoder puts several formats in one place.