Base64 Studio

How to use Base64 Studio

1. Pick a mode. Text mode converts words and sentences, including text in any language or script. File mode converts a whole file to Base64, or turns pasted Base64 back into a downloadable file.
2. Set the alphabet before you start. Leave URL-safe off for email attachments, data files and most developer tools. Turn it on when the result will travel inside a URL, a filename or a token. If you plan to drop padding, do that here too — decoders vary in how strict they are.
3. Encode or decode. In Text mode, type or paste into the first box and choose Encode or Decode. Decoding tolerates missing padding and line breaks copied from an email or a document, and the status line tells you the byte and character counts involved.
4. Read any error literally. If decoding fails, the message names the offending character and its exact position in your input, so you can find and fix it instead of pasting the whole string somewhere else to guess again.
5. Copy, or download. Copy the result from the output box, or — in File mode — paste Base64 into the decode area, give it a file name with the right extension, and download the rebuilt file.

Worked example

The sample sentence is Base64 turns café text into safe ASCII. — chosen because it is not plain ASCII: its 39 characters include an é, which takes two bytes in UTF-8, so the text is 40 bytes before encoding. That is exactly the case a careless encoder gets wrong, by throwing an error or quietly mangling the accented letter. Select Load sample and the workspace fills with that sentence and encodes it with the standard alphabet and padding on, producing this output character for character:

QmFzZTY0IHR1cm5zIGNhZsOpIHRleHQgaW50byBzYWZlIEFTQ0lJLg==

The counts agree with the arithmetic on this page: 40 bytes become 56 Base64 characters, because every three bytes turn into four characters, rounded up. With the URL-safe alphabet selected and padding switched off, the same sentence encodes to QmFzZTY0IHR1cm5zIGNhZsOpIHRleHQgaW50byBzYWZlIEFTQ0lJLg — 54 characters, identical except for the missing == at the end, because this particular text happens to produce no + or / characters for the alphabets to disagree about. Decode either version in Text mode, with its matching alphabet setting, and you get the original sentence back, accent intact.

What Base64 is, and what it is not

Base64 is a way of writing arbitrary bytes using only 64 safe characters: the letters, the digits, and two punctuation marks. It exists because many systems that move information around — email above all, but also web addresses, configuration files, data URIs and API tokens — were built for plain text and will damage, truncate or reject raw binary data. Encoding a file as Base64 turns it into a long, boring, dependable string of text characters that every one of those systems can carry untouched. At the far end, decoding turns the string back into exactly the bytes that went in. Nothing is compressed and nothing is summarised: the output is fully reversible by design, and it is about a third larger than the input, because four Base64 characters carry only three bytes of data.

That size cost is why Base64 is a transport format, not a storage strategy. Embedding a photograph directly in a web page or a document as Base64 makes that page a third heavier than the photograph itself, and the embedded copy cannot be cached separately the way a normal image file can. The honest uses are the ones where text is the only road available: an attachment inside an email, an image inlined in a CSS file or a single-file document, a binary value that has to pass through a JSON field, a key or certificate that must be pasted into a settings screen.

Two misunderstandings cause most of the trouble with Base64. The first is treating it as protection. It is not encryption, not hashing and not a password: anyone who sees a Base64 string can decode it in seconds — this page will do it — so never encode a secret and call it secured. The second misunderstanding is treating every Base64-looking string as text. Encoded photographs, PDFs and programs decode to bytes that are meaningless, and sometimes invalid, as text. That is why Text mode here decodes strictly as UTF-8 and refuses byte sequences that are not real text, pointing you to File mode instead, rather than handing back a page of replacement characters and pretending the job succeeded.

The two alphabets exist because the standard one contains + and /, both of which mean something special inside a web address. The URL-safe variant swaps them for - and _ and is otherwise identical — same bytes, same padding rules, same size. Mixing them up is the commonest real-world failure: the string looks fine, but a strict decoder rejects characters from the wrong alphabet, which is why this tool validates character by character and its error message names both the character and where it sits.

Common errors, and the limits of this tool

The most common error is a corrupted paste: a character dropped by a word processor that wrapped the string, a smart quote substituted by a document editor, or the first line of an email header included by accident. Because a single wrong character changes the bytes, the decoder here checks every character and reports the first one that cannot belong, with its position. The second common error is double encoding — encoding text that was already encoded — which decodes once into more Base64 rather than into your file; if your result still looks like Base64, decode it again and check whether that was intended. The third is expecting Base64 to remember what the file was. It does not: no name, no extension, no type. A download named wrongly is still the right bytes, so renaming decoded-file.txt to the extension the data actually needs usually fixes an “unreadable” result.

The limits are these. Text mode accepts up to 1,000,000 characters and File mode up to 10 MB, because the input, the encoded form and the output field must all fit in the browser tab’s memory at once; these are practical caps of running in a web page, and larger files should be encoded with a desktop or command-line tool. Text mode decodes as UTF-8 only, so binary data belongs in File mode. The tool checks characters, length and padding carefully, but it cannot know what the decoded bytes were supposed to be — a string of valid Base64 that encodes the wrong file will decode perfectly, into the wrong file. And nothing here verifies identity or safety: a decoded file deserves the same caution as a file from any other source before you open it.

Frequently asked questions

How it works

Base64 Studio converts between ordinary text or files and Base64, the text-safe encoding that represents binary bytes with letters, digits, and a couple of symbols. In text mode, type or paste your text and encode it, or paste a Base64 string and decode it back; the text mode is UTF-8 safe, so accented characters survive the round trip instead of being corrupted. A file mode handles whole files, and a URL-safe variant swaps the standard alphabet for one that is safe inside web addresses. If decoding fails, the tool checks every character and reports the first one that cannot belong, together with its position, so you can find the fault. Everything runs in your browser and nothing is uploaded. When you are finished, copy the result straight into the place that needs it, since a Base64 string pasted through a word processor can pick up altered characters or line breaks that break decoding later.

Another worked example

Sam Rivera, a fictional developer, needs to pass a short fictional token through a system that only accepts plain text. Sam types the fictional string example-token-123 and encodes it. Input: example-token-123. Result: ZXhhbXBsZS10b2tlbi0xMjM=. Decoding that string returns the original token exactly. Later, Sam pastes a string copied from an email and decoding fails at one character position; checking that spot reveals a character that a word processor had altered, and fixing it lets the decode succeed.

More limitations to know

Base64 is an encoding, not encryption: anyone can decode a Base64 string, so it must never be used to hide a password or other secret. A single wrong character changes the decoded bytes, so a paste damaged by line-wrapping, a smart quote substituted by a document editor, or a stray email header will fail or decode incorrectly. Double encoding is another trap: encoding text that is already encoded decodes once into more Base64, not into your original file, so if the result still looks like Base64, check whether a second decode was intended.

More frequently asked questions