Base64 and URL encoding in a nutshell
Many systems can only carry plain text safely: HTTP headers, JSON fields, e-mail bodies or query strings.
Base64 solves this by representing any binary data – an image, a certificate, a compressed payload –
with 64 printable characters, at the cost of about 33% extra size. URL encoding (percent-encoding,
RFC 3986) replaces characters that have a special meaning in a URL, such as spaces, & or
?, with sequences like %20, so that values travel through links and forms without breaking
them. This tool encodes and decodes both formats, with full UTF-8 support for accents, emoji and any other script.
Options explained
- URL-safe (base64url) swaps
+and/for-and_. It is the variant used by JWTs and many APIs because it can be placed in URLs and file names. - No padding removes the trailing
=characters. When decoding, both alphabets, line breaks and missing padding are detected automatically. - Full URL encodes a complete address while keeping its structure (
:,/,?,&…). Leave it off to encode a single query parameter value. - Spaces as + follows the HTML form convention (
application/x-www-form-urlencoded).
Files and binary data
Choose Encode a file to turn any file into Base64 or into a data: URI that you can embed in
HTML or CSS. When you decode Base64 that is not text, the tool detects the file type (PNG, JPEG, PDF, ZIP…), shows a
preview and a hex dump, and lets you download the original file. Everything runs in your browser: files and text are
never uploaded.
Practical examples
HTTP Basic authentication
The header Authorization: Basic dXNlcjpzZWNyZXQ= is simply user:secret encoded in Base64 – which
is why Basic auth must always travel over HTTPS. Decode it here to inspect the credentials your client sends.
Command-line equivalents
$ printf 'hello' | base64 # aGVsbG8=
$ echo 'aGVsbG8=' | base64 -d # hello
$ python3 -c "import urllib.parse as u; print(u.quote('a b&c'))" # a%20b%26c
Encoding is not encryption
Base64 and URL encoding only change the representation of data; anyone can reverse them instantly. Never rely on them to hide passwords, tokens or personal information.