---
title: "Base64 Encoder / Decoder"
description: "Encode and decode text with Base64. Supports the URL-safe variant. Unicode-aware."
url: https://sade.dev/en/tools/base64/
lang: en
author: "Muhammet Şafak"
published: 2026-04-03
updated: 2026-08-30
section: Tool
tags: ["base64","encoding"]
---

# Base64 Encoder / Decoder

> Encode and decode text with Base64. Supports the URL-safe variant. Unicode-aware.

Base64 is an encoding that represents binary data with 64 printable ASCII characters
(`A-Z`, `a-z`, `0-9`, `+`, `/`). It expresses 3 bytes as 4 characters, which means it
causes roughly a **33% size increase**.

## What is it used for?

- Carrying binary data in HTTP headers (e.g. Basic Auth).
- Attachment encoding in email (MIME).
- Data URLs (`data:image/png;base64,...`).
- The header and payload parts of a JWT (with the URL-safe variant).

## The URL-safe variant

Standard base64 uses the `+` and `/` characters, but these have special meaning in
URLs. The URL-safe variant (RFC 4648 §5):

- `+` → `-`
- `/` → `_`
- `=` padding is usually dropped

Protocols like JWT and OAuth use the URL-safe variant.

## A note on Unicode

Base64 works on bytes, not on characters. JavaScript's `btoa`/`atob` functions, on the
other hand, misleadingly assume **Latin-1**: the threshold is U+00FF. Characters above
it — `ğ`, `ı`, `İ`, `ş` and every emoji — throw an `InvalidCharacterError` when handed
straight to `btoa`. The more dangerous case is the one below it: `ç` (U+00E7), `ö`
(U+00F6) and `ü` (U+00FC) sit in the Latin-1 Supplement block, so `btoa` does not
throw — it silently produces the wrong bytes. `btoa("çöp")` returns `5/Zw`, which is
Latin-1, not UTF-8. Silent corruption is more dangerous than an exception.

This tool first converts the text to **UTF-8 bytes** and then base64-encodes it — so
Turkish characters and emoji work safely.

## Privacy

Encoding and decoding run entirely in your browser. The text you paste never leaves
your browser.