Guides / Dev utilities

Base64 Encoding Explained: How to Encode and Decode Text

Last reviewed October 12, 2026

Base64 shows up in email attachments, web tokens, data URLs and API requests. It looks like random letters, which leads people to think it is a kind of encryption. It is not. This guide explains what Base64 does, when to use it, and how to encode or decode text in seconds.

What Base64 is

Base64 is a way of writing any data using only 64 safe characters: the letters A to Z and a to z, the digits 0 to 9, plus and slash, with equals signs as padding. Many older systems, such as email and some web formats, can only carry plain text safely. Base64 lets binary data or text with unusual characters pass through them without being damaged.

The price is size. Base64 text is about one third larger than the original data.

Base64 is not encryption

Anyone can turn Base64 back into the original data, with no key or password. It hides nothing. Never use it to protect a password, token or private message. If you need secrecy, use real encryption. Base64 is only a transport format.

How to encode or decode text

  1. Open Dev utilities and choose the base64 tab.
  2. Type or paste your text into the box.
  3. Choose Encode to turn plain text into Base64, or Decode to turn Base64 back into text.
  4. Copy the result.

For example, the text Hello, Anvil encodes to SGVsbG8sIEFudmls, and decoding that string returns the original words.

Where you will see it

  • Data URLs, where a small image is embedded directly in a web page or stylesheet.
  • Email attachments, which are encoded so they can travel as text.
  • HTTP Basic authentication headers, which carry a username and password as Base64 (and are therefore only safe over HTTPS).
  • JSON Web Tokens (JWT), whose header and payload sections are Base64 variants that anyone can read.
  • Configuration systems such as Kubernetes secrets, which store values as Base64 although that does not protect them.

Why decoding sometimes fails

  • The text contains characters outside the Base64 alphabet, such as spaces, line breaks or quotation marks that were copied along with it.
  • The string is cut short, or its padding equals signs were removed.
  • It is the URL-safe variant, which uses dashes and underscores instead of plus and slash. Replace those characters first.
  • The decoded bytes are not text, for example the Base64 of an image. Decoding it to text will not give a readable result.

Next, see how hashes differ from encoding in MD5 vs SHA-256 and how to check a file hash.

Try it now

Open the Dev utilities tool. It is free, needs no account, and your files are deleted right after conversion.

Related guides