Runs entirely in your browser — nothing leaves this page.
Base64
Encode / decode, UTF-8-safe, URL variant.
What Base64 is for
Base64 turns arbitrary bytes into an alphabet that survives systems built for text — HTTP headers, JSON fields, email bodies, YAML values. It is a transport encoding, and it is fully reversible by anyone.
The URL-safe variant swaps the two characters that break in query strings and paths, and drops the padding. It is what JWTs, OAuth state and most APIs use.
Is Base64 encryption?
No, and treating it as such is a recurring cause of leaked credentials. Anyone can decode it in one step, with no key. A Kubernetes Secret stores values in Base64 for transport, not for protection — that is exactly why committing one to git is a real incident.
When do I need the URL-safe variant?
Whenever the value travels in a URL path, query string or filename. Standard Base64 uses + and /, which are reserved there, so a normal encoder produces strings that break silently after a proxy rewrites them.
Why does my decoded text come out with broken characters?
The input was probably not UTF-8 text to begin with — binary data decoded as text always looks like that. It can also mean the string was truncated: Base64 works in four-character blocks, and a copy-paste that lost the tail corrupts the last bytes.
Related tools: JWT decoder, Punycode and YAML / JSON / TOML.