Base64 turns any data into a string of 64 safe characters (A–Z, a–z, 0–9, + and /). It is not encryption — anyone can decode it. Its job is to let binary data travel safely through systems that only expect text, like email, JSON or a data URI in a web page.
When you actually need it
- Embedding a small image directly in HTML or CSS as a
data:URI. - Putting binary data inside a JSON payload or an HTTP header.
- Reading the payload of a JWT, whose three parts are Base64url-encoded.
How to encode or decode
- Open the Base64 tool.
- Paste your text and choose encode or decode.
- Copy the result. Everything runs locally, which matters because Base64 is trivially reversible.
Why you should not paste secrets into random sites
Because Base64 is reversible, encoding a password or token does nothing to protect it. If you decode or encode anything sensitive on a website that sends your input to a server, you have just handed that server your data in a form it can read instantly. A browser-only tool avoids that entirely.
Base64url is a small variant that swaps + and / for - and _ so the string is safe inside URLs and JWTs. It decodes the same way; only those two characters differ.