Is Base64 encryption?

No. It is a reversible encoding with no key, designed to move bytes through text-only channels. Anyone can decode it instantly, so it provides zero confidentiality.

Why does my Base64 string end in one or two equals signs?

Padding. Base64 works on 3-byte groups; if the input length leaves one byte over you get two '=' characters, and two bytes over gives one '='. A string whose length is a multiple of three needs no padding at all.

What is the difference between Base64 and Base64URL?

Base64URL replaces '+' with '-' and '/' with '_' and usually omits padding, so the result is safe in URLs and filenames. JWTs, OAuth PKCE challenges and webhook signatures use the URL variant.

Does encoding happen in my browser?

Yes. Text is encoded and decoded locally with TextEncoder and the browser's Base64 primitives; nothing is transmitted unless you deliberately call the API endpoint.

Developer🔒 Browser (client-side)API available📴 Works offlinebeginner

Base64 Text

Encodes text to Base64 or decodes Base64 back to readable text.

Data stays in your browser

Ready to runInstant execution

All tools →

Text to Encode/Decode

Result

—

What does this tool do?

Encodes text to Base64 or decodes Base64 back to readable text.

Why would I use it?

You need to embed binary-safe text in a URL, header or email.
You received a Base64 blob and want to read its content.
You are preparing API payloads that require Base64.

Real-life example

Input

hello world

Output

aGVsbG8gd29ybGQ=

Encoding is reversible — decoding returns the original text.

Input → Process → Output → Next

Input: Type or paste text (or Base64).
Process: The browser encodes/decodes with UTF-8 handling.
Output: The encoded or decoded string.
Next action: Copy the result. For URLs, prefer URL-safe Base64 to avoid + and / characters.

Common mistakes

Thinking Base64 is encryption — it is encoding and anyone can decode it.
Decoding data that is not Base64 (garbage output).
Using it for passwords — never encode secrets with Base64.

What the result means

Base64 represents the same bytes in an ASCII-safe alphabet; it is not secure.

Privacy & security

Your input is processed entirely in your browser and never sent to a YAS server.

API

Endpoint

POST https://yas.sh/api/v1/tools/base64-text

Request Header

Content-Type: application/json

cURL

curl -X POST "https://yas.sh/api/v1/tools/base64-text" \
  -H "Content-Type: application/json" \
  -d '{"input":"hello world","mode":"encode"}'

JavaScript

const res = await fetch("https://yas.sh/api/v1/tools/base64-text", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({
  "input": "hello world",
  "mode": "encode"
}),
});
const data = await res.json();

Python

import requests

r = requests.post("https://yas.sh/api/v1/tools/base64-text", json={"input":"hello world","mode":"encode"})
data = r.json()

Field	Type	Required	Description
input	string	Yes	Text to transform (≤ 64 KB)
mode	"encode" \| "decode"	No (default "encode")	Direction

Success response

{ "slug": "base64-text", "result": "aGVsbG8gd29ybGQ=", "mode": "encode" }

Encode or decode a UTF-8 string with Base64.

Error responses

400 VALIDATION_ERROR — invalid input or unsupported option.
413 PAYLOAD_TOO_LARGE — input exceeds the 64 KB limit.
429 RATE_LIMIT_EXCEEDED — rate limit exceeded (60 req/min).

Limits

Maximum input: 64 KB per request.
Rate limit: 60 requests/min per IP address.
Authenticated accounts benefit from higher tier quotas.

How Base64 Text works

Base64 maps arbitrary bytes onto a 65-character alphabet that survives text-only channels. The encoder takes three input bytes (24 bits), splits them into four 6-bit groups, and maps each group through the alphabet A–Z, a–z, 0–9, + and / defined in RFC 4648 §4. When the input length is not a multiple of three, the final group is zero-padded and one or two '=' characters mark how many bytes of the last quantum are real.

Text has to become bytes before any of that can happen. This tool encodes the input as UTF-8 first, so 'é' is the two bytes C3 A9 and encodes to w6k=, not to a single byte. That UTF-8 step is exactly what the legacy btoa() function does not do — btoa throws InvalidCharacterError on any code point above U+00FF, which is the source of most 'why does Base64 break my emoji' bug reports.

The output is always about 33% larger than the input: every 3 bytes become 4 characters, plus padding. Base64 is an encoding, not compression and not encryption — the transformation is fully reversible by anyone, with no key involved.

When to use it: real-world scenarios

Building an HTTP Basic Authorization header

The header value is the literal string 'Basic ' followed by base64(username:password). Encoding the pair here shows you exactly what your client should send, which is useful when a colon inside the password is being mis-parsed.

Embedding a small asset in CSS or HTML

A data URI (data:image/svg+xml;base64,...) removes one network round trip for an icon. The 33% size penalty means this pays off only below roughly 4 KB; beyond that a separate cacheable file wins.

Moving binary data through a JSON field

JSON strings cannot carry raw bytes, so binary payloads are Base64-encoded into a string property. This is how certificate bodies, protobuf blobs and image bytes travel through REST APIs.

Decoding a JWT segment by hand

The header and payload of a JWT are Base64URL, a variant that swaps + for - and / for _ and drops padding. Decoding a segment shows the claims; use the JWT Decoder for the full token, including signature-algorithm detail.

Pro tips

Use the Base64 URL tool, not this one, for anything that goes into a URL path, query string, filename or JWT — '+' becomes a space and '/' becomes a path separator when a standard Base64 string is placed in a URL.
Decoders differ on padding. Some accept unpadded input, some reject it. If a decode fails, add '=' characters until the string length is a multiple of four.
Line breaks are legal in MIME Base64 (RFC 2045 wraps at 76 characters) but illegal in strict RFC 4648. Strip whitespace before decoding if a parser complains.
Base64 is not obfuscation with any security value. Anything encoded in a client-side bundle, a cookie or a URL is readable by anyone who copies it into this page.

Limitations and edge cases

What this tool deliberately does not do, and where it will disagree with other implementations.

Encoding inflates size by roughly one third. Do not Base64 large files into JSON if a multipart upload is available.
Files are not handled here — this tool encodes text. Use the Base64 File tool for binary input, which reads bytes directly rather than going through a UTF-8 text step.
Decoding a string that was never valid Base64 produces mojibake rather than an error when the length happens to be a multiple of four and every character is in the alphabet.
The API path accepts up to 64 KB of input; larger payloads must be chunked or encoded locally.

Frequently asked questions

Is Base64 encryption?: No. It is a reversible encoding with no key, designed to move bytes through text-only channels. Anyone can decode it instantly, so it provides zero confidentiality.
Why does my Base64 string end in one or two equals signs?: Padding. Base64 works on 3-byte groups; if the input length leaves one byte over you get two '=' characters, and two bytes over gives one '='. A string whose length is a multiple of three needs no padding at all.
What is the difference between Base64 and Base64URL?: Base64URL replaces '+' with '-' and '/' with '_' and usually omits padding, so the result is safe in URLs and filenames. JWTs, OAuth PKCE challenges and webhook signatures use the URL variant.
Does encoding happen in my browser?: Yes. Text is encoded and decoded locally with TextEncoder and the browser's Base64 primitives; nothing is transmitted unless you deliberately call the API endpoint.