Encoding

Base64

Encode text as Base64 or decode it back, with standard and URL-safe alphabets. Text is handled as UTF-8.

Base64 options

Direction
Mode

RFC 4648 §4 — A–Z a–z 0–9 + / with = padding

Keyboard shortcuts

Esc
Close a menu or overlay, then leave full screen
↓ on a menu
Open it; ↑ ↓ move through its items
← → in the menu bar
Move between menus

Where your data goes
Using this page Using the API, MCP or A2A
Where it runs In your browser. Text is converted to UTF-8 bytes with TextEncoder and encoded with the browser's btoa/atob. In a Cloudflare Pages Function at the Cloudflare data centre nearest the caller.
What leaves your device Nothing you enter. After the page and its scripts load, no request carries your input. The browser enforces this: the page's Content-Security-Policy sets connect-src 'none' and form-action 'none', which block fetch, XHR, WebSocket, EventSource, beacons and form posts.

The server receives the input text and mode, converts it in memory inside the request, and returns the result. Your input is not stored or logged; only the per-call metadata row (operation, time, status, sizes) is recorded. Send secrets in a POST body, not the query string: URLs are recorded in Cloudflare request logs, proxies, and shell history.
Stored Nothing leaves the page. No cookies, analytics or third-party scripts; the browser keeps only your View → Inline config choice. Your inputs and results: never. What is stored is your client record (client ID, a SHA-256 hash of your secret, expiry, and the profile you registered with) and one metadata row per call: operation, time, transport, status, error code, duration, request and response sizes, and country.
Logged Nothing (no requests are made). Only the per-call metadata above, attributed to your client ID. Never parameters, bodies, results, or credentials. Cloudflare, as the host, also processes request metadata (IP address, full URL including the query string, headers) under its own policies, so put inputs in POST bodies.
Access Open to anyone. Requires a client ID and secret (how to get one). HTTPS only; TLS terminates at Cloudflare.

Details and how to verify this yourself: Security & privacy.

User guide

The tool sits in a window that works like a desktop app: menus on the top row and the full-screen icon at its right (Esc leaves full screen). The set-up options described below are in Settings → Options…, an overlay, and the Settings menu also lists the common choices directly. To keep the options in view instead, choose View → Inline config; the page remembers that choice. Help → Keyboard shortcuts… lists the keys.

  1. Choose Encode or Decode.
  2. For encoding, choose Standard (the usual choice, for MIME, data: URLs and PEM bodies) or URL-safe (for JWTs, URL parameters and file names).
  3. Type or paste your input. The output updates as you type.

Decoding is forgiving. The decoder accepts either alphabet, with or without = padding, and ignores spaces and line breaks. That means you can paste a wrapped PEM body or a JWT segment directly. The mode buttons only affect encoding.

“Decoded bytes are not valid UTF-8 text”. The Base64 is valid, but it encodes binary data (an image, a key, compressed data) rather than text, and this tool only displays text. To check the bytes, use the Hex tool on the same data, or the API’s /api/hash with input_base64.

Specification
  • Standards.
    • Standard mode: RFC 4648 §4 (A–Z a–z 0–9 + /, padded with =).
    • URL-safe mode: RFC 4648 §5 (- and _ in place of + and /, no padding: the JWT/RFC 7515 convention).
  • Text handling. Input text is encoded as UTF-8 before Base64 encoding, so é (U+00E9) becomes bytes C3 A9 and then w6k=. The browser’s btoa on its own would throw on non-Latin-1 text; this tool doesn’t.
  • Decoding rules.
    1. Remove all whitespace.
    2. Map - → + and _ → /.
    3. Reject any character outside the alphabet, and padding that isn’t at the end.
    4. Reject a length ≡ 1 (mod 4), which can never be valid.
    5. Restore missing padding.
    6. Decode the bytes as UTF-8 in fatal mode: invalid UTF-8 is an error, never silently replaced with �.
  • Line wrapping. Encoded output is never wrapped. MIME’s 76-character lines and PEM’s 64-character lines are not added.
  • Limits. Browser memory only. The API accepts up to 1 MiB, and encodes in 32 KiB chunks to avoid call-stack limits.

API & MCP

The same logic is available over HTTP and as MCP tools. Unlike this page, these run on the server: see where your data goes.

GET POST /api/base64/encode Encode text as Base64 (RFC 4648). MCP tool base64_encode · 2 parameters · full reference → GET POST /api/base64/decode Decode Base64 to UTF-8 text. MCP tool base64_decode · 2 parameters · full reference →