Base64 & URL Encoder

Nothing leaves your device

This tool runs entirely in your browser using the built-in btoa, atob and URI encoding functions. Your input is never sent to a server, never logged and never stored. That matters if you're decoding something that turned up in an email header or a log file and you don't yet know what's inside it.

What Base64 actually does

Base64 converts binary data into 64 printable ASCII characters — A–Z, a–z, 0–9, plus + and /, with = as padding. It exists because many systems were built to carry text and will mangle raw bytes. Encoding lets an image, a certificate or a file attachment travel safely through an email header or a JSON field.

Base64 is not encryption.

Anyone can decode it instantly — this page does it in a keystroke. It offers no confidentiality whatsoever. Treat encoded data as fully readable, and never use it to hide a password, an API key or anything else you actually need protected. Encoding solves a transport problem, not a security one.

One practical consequence: Base64 output is about 33% larger than the input, because every three bytes become four characters. That's why embedding large images directly in a page as data URIs bloats it.

URL encoding, and why it is different

URL encoding (percent-encoding) solves a separate problem. Certain characters carry structural meaning inside a web address — ? starts the query string, & separates parameters, # begins a fragment. If those characters appear in your data rather than your structure, they have to be escaped or the address breaks.

Encoding replaces each one with a percent sign and its hexadecimal byte value: a space becomes %20, an ampersand becomes %26, a slash becomes %2F. Non-English characters are encoded as their UTF-8 bytes, so a single accented letter often becomes two percent-escapes.

Which one do you need?

• Base64 encode — you need to move binary data through a text-only channel, or build a Basic Auth header or a data URI.
• Base64 decode — you've found a long string of letters and digits ending in = and want to know what it says. Common in email headers, JWT payloads and config files.
• URL encode — you're putting a value containing spaces or symbols into a query string.
• URL decode — you're reading a link cluttered with %20 and want it legible. Useful when inspecting a suspicious link before you click it.

When decoding fails

Base64 decoding is strict. It fails if the string has been truncated, if padding is missing, or if it was copied with line breaks or stray spaces. It also fails on URL-safe Base64, a variant that swaps + and / for - and _ — substitute those back before decoding.

If a decode produces unreadable characters, the input was probably an image, a compressed archive or another binary format rather than text. That's a correct result, not an error.

A note on suspicious links

Attackers routinely bury redirect destinations inside encoded parameters, and a heavily percent-encoded link is often designed to stop you reading where it goes. Decoding one here is safe, because nothing is fetched or opened — you're only converting text. Seeing the real destination first is a genuinely useful habit.

Frequently asked questions

Is my data uploaded anywhere?

No. Encoding and decoding happen entirely in your browser using built-in JavaScript functions. Nothing is transmitted, logged or stored on any server.

Is Base64 a form of encryption?

No. Base64 is an encoding, not a cipher, and anyone can reverse it instantly without a key. It provides no confidentiality and should never be used to protect passwords, keys or sensitive data.

Why does my Base64 string fail to decode?

The usual causes are a truncated string, missing padding characters, or line breaks and spaces introduced when copying. URL-safe Base64, which uses hyphen and underscore in place of plus and slash, also needs converting back before it will decode.

What is the difference between Base64 and URL encoding?

Base64 turns binary data into printable text so it can travel through text-only channels. URL encoding escapes characters that have structural meaning inside a web address, such as spaces, ampersands and question marks, so they are treated as data instead.

Can I decode a suspicious link safely here?

Yes. The tool only converts text and never fetches or opens anything, so decoding a link to see where it really points carries no risk.