Base64
Decoder

Data URIs embed images, fonts, and small files directly inside HTML or CSS as data:image/png;base64,iVBORw0KGgo…. Useful for icons under 4 KB that would otherwise cost an HTTP round-trip. Above 4 KB the encoding penalty (Base64 is 33 % larger than raw bytes) outweighs the round-trip savings, so use sprite sheets or HTTP/2 multiplexing instead.

HTTP Basic Auth sends credentials as Authorization: Basic <base64(user:password)>. This is encoding, not encryption — anyone with the header can decode the credentials in one step. Only safe over TLS. The decoder is the fastest way to inspect a curl -v dump and verify which user is being authenticated.

JWT tokens are three Base64URL segments separated by dots: header.payload.signature. The header and payload are JSON, the signature is binary. Base64URL replaces + with - and / with _ and drops padding. ConverterUp auto-detects this and parses JWTs correctly without manual padding adjustment.

Email attachments over SMTP use Base64 (specifically MIME Base64 with line breaks every 76 chars) because SMTP was designed for 7-bit ASCII text. Cryptographic keys and certificates in PEM format (-----BEGIN PRIVATE KEY-----) are Base64 wrapped around DER binary. SVG inlining, CSP nonces, OAuth state tokens, WebAuthn credential IDs — Base64 is everywhere in modern web infrastructure.

ToolSeo.base64-decode.section1.p5

Encoding takes raw bytes (text, binary, image) and produces a Base64 ASCII string. The output is always 33 % larger than the input (3 input bytes → 4 output chars), padded with = to make the length a multiple of 4. Encoding is deterministic and lossless: encode then decode and you get the exact original bytes back.

Decoding reverses the process. Take 4 Base64 chars → produce 3 bytes. The input must be valid Base64 — invalid characters (anything outside A-Za-z0-9+/=) cause failures unless the decoder is lenient. ConverterUp's decoder is lenient by default: it strips whitespace, line breaks, and unknown characters before decoding, which matches how most production tools (Python's base64.b64decode, Node's Buffer.from) behave.

Text encoding inside Base64 is a separate concern. Base64 encodes bytes, not characters. If you Base64-encode the string café, the result depends on whether you encoded UTF-8 bytes (5 bytes → Y2Fmw6k=) or Latin-1 bytes (4 bytes → Y2Fm6Q==). On decode you must know the original encoding. ConverterUp tries UTF-8 first, falls back to Latin-1 on decode failure, and exposes a raw hex view for binary content.

The padding question: standard Base64 always pads to a multiple of 4 with =. Base64URL (used by JWT, OAuth, WebAuthn) often strips the padding because URLs hate =. The decoder reconstructs missing padding automatically — a string of length 22 needs 2 padding chars to reach 24. If your decoder is strict about padding, add the right number of = manually before passing it in.

ToolSeo.base64-decode.section2.p5

URL-safe Base64 (Base64URL, RFC 4648 §5) replaces two characters: + → -, / → _. The padding char = is also typically dropped. Standard decoders reject URL-safe input; URL-safe decoders accept both. ConverterUp accepts both and produces standard Base64 on encode (toggle to Base64URL when you need it for a JWT or OAuth flow).

Padding errors are the #1 source of 'invalid Base64' bugs. A token of length 11 cannot decode — Base64 strings must be a multiple of 4. The fix is to append 1, 2, or 3 = until the length is a multiple of 4. Some tools silently accept unpadded input; some throw an error. If you see 'incorrect padding', add equals signs until the length divides by 4.

Line breaks in MIME Base64 (RFC 2045) come every 76 chars because old SMTP servers had line-length limits. Modern decoders strip line breaks before decoding, but some strict implementations do not. If you see decode errors on a Base64 blob from an email or PEM file, run a regex replace /\s/g first to collapse all whitespace, then decode.

Encoding does not encrypt. This is worth repeating because Base64 looks like ciphertext and even experienced developers occasionally treat it as obfuscation. Anyone with the Base64 string can recover the original bytes instantly. Never use Base64 to 'hide' API keys, passwords, or PII — it adds zero security. Use real encryption (AES-GCM, age, libsodium) for actual secrets, and treat Base64 purely as a binary-to-ASCII transport format.

ToolSeo.base64-decode.section3.p5

ToolSeo.base64-decode.section4.p1

ToolSeo.base64-decode.section4.p2

ToolSeo.base64-decode.section4.p3

ToolSeo.base64-decode.section4.p4

ToolSeo.base64-decode.section4.p5

ToolSeo.base64-decode.section5.p1

ToolSeo.base64-decode.section5.p2

ToolSeo.base64-decode.section5.p3

ToolSeo.base64-decode.section5.p4

ToolSeo.base64-decode.section5.p5