Base64 β sending data down a road that only carries letters
Email and URLs were built to carry text, not arbitrary bytes. Base64 rewrites anything at all using 64 characters that are safe to send. It is packaging, not encryption β anyone can unwrap it.
An email body, a web address, a config file: all designed for text. Put the raw bytes of an image in one and something along the way will read a byte as a line break and truncate the rest. So the data is rewritten using only AβZ, aβz, 0β9 and two punctuation marks.
Because six bits become one character, the result is larger than the original β about a third larger. Text outside the Latin alphabet grows more in absolute terms, since each character was already several bytes before encoding started.
What it actually produces
| Input | Bytes | Base64 |
|---|---|---|
| hello | 5 | aGVsbG8= |
| μλ νμΈμ | 15 | 7JWI64WV7ZWY7IS47JqU |
| γγγ«γ‘γ― | 15 | 44GT44KT44Gr44Gh44Gv |
There are two alphabets
Standard base64 uses + and / for its last two characters and pads the end with =. All three mean something else in a URL: / separates path segments, + means a space, and = assigns a value.
So the URL-safe variant swaps + for - and / for _, and drops the padding. JWTs use that form, and wanting to see what is inside a token is one of the commonest reasons to open a base64 tool at all.
This tool reads either without being told which. When encoding, you choose.
Errors that say what went wrong
Base64 fails to decode for a few distinct reasons, and most tools report all of them as one line. Knowing which one you have is what lets you fix it.
The distinct failures
| Input | What it means |
|---|---|
| !!!! | characters that base64 cannot contain |
| QUJDR | the length is wrong β part of it is missing |
| /////w== | it decoded, but not to text β an image or a file |
It is not encryption
This is the common misunderstanding. Base64 has no key and anyone can reverse it. Storing a password or personal data as base64 is writing it on a postcard rather than putting it in an envelope.
The same applies to a JWT. Its signature prevents forgery; it does not hide the contents. The name and permissions inside a token are readable by anyone β including by this tool.
When this is the right tool
- β’Reading what is inside a JWT.
- β’Decoding a base64 value found in a config file or an API response.
- β’Embedding a small image directly in HTML or CSS as a data: URI.
- β’Unpacking an encoded subject line from an email header.
- β’Moving a value safely past something that would mangle line breaks.
Frequently asked questions
Can it handle values split across lines?
Yes. Email and certificate files conventionally wrap base64, so whitespace and line breaks are ignored.
There is no = at the end and it still worked.
The URL-safe form conventionally omits the padding. The length says how much is needed, so it is restored automatically.
Can I convert a file?
This tool works with text. Paste a file's base64 and you are told it does not decode to text β which is a fact about the value, not a failure.
Is anything sent anywhere?
No. The conversion runs in your browser, tokens included.