Guide
Koder Base64: what it does and how to use it
The Base64 tool encodes text to Base64 and decodes Base64 back to text. Base64 is not encryption. It is a way to write binary-safe data with characters that survive email, JSON, XML, and URLs that dislike raw bytes. You will see it in data URLs, basic auth headers, and tokens that are merely packed, not secret.
Encode takes whatever you typed and produces a standard Base64 string, including Unicode. Decode expects Base64 and returns the text. If the input is not valid Base64, decode stops and says so instead of printing garbage and pretending it worked.
This box is for text. It does not upload or encode a file from disk. Pasting a huge binary as text is the wrong job; for a short string, a header, or a snippet you are debugging, the box is enough. Encoding and decoding stay in the browser.
How to use it
- 1
Paste the text or the Base64 string
Put the source in Input. For decoding, extra space at the ends is trimmed. The characters in the middle still have to be real Base64.
- 2
Choose Encode or Decode
Encode turns text into Base64. Decode turns Base64 into text. Pick the direction that matches what you pasted — running encode on text that is already Base64 will encode it a second time.
- 3
Check the error line
Decode shows “Invalid Base64 input” when the alphabet or padding is wrong. Encode fails only if the text cannot be turned into bytes, which is rare for normal pasted text.
- 4
Copy the result
Copy writes the output to the clipboard once a result exists.
Good uses
- Decoding a Basic credential or a data snippet to see the text inside.
- Encoding a short Unicode string so it can sit inside a header or a JSON field.
- Checking whether a value is Base64 at all before you treat it as a token.
- Teaching the difference between encoding and encryption with a live example.
Tips
- If decode fails, look for a missing = pad, a line break in the middle, or characters that are not in the Base64 alphabet.
- URL-safe Base64 uses - and _ instead of + and /. This decoder expects standard Base64. Swap those characters back before decoding if a URL gave you the safe variant.
- Do not put passwords or private keys in a shared browser window just to encode them. Base64 hides nothing from someone looking at the output.
- A string that decodes to unreadable symbols was probably binary, not text. This tool always tries to show text.
Limits to know
- Text in, text out. There is no file picker and no image preview.
- It is not a cipher, a hash, or a signer. Anyone can decode the output.
- URL-safe Base64 is not accepted until you convert it back to the standard alphabet.
Questions
Is Base64 a secure way to hide a password?+
No. It is reversible by design. Use it to transport data, not to protect it.
Does it handle letters outside English?+
Yes. Encode and decode go through Unicode, so accented letters and other scripts round-trip as text.
Why did decode fail on a string I copied from a URL?+
Query strings often use URL-safe Base64. Replace - with + and _ with /, and restore padding, then decode again.
Is the text sent to a server?+
No. btoa and atob run in the page.