Paste Base64 to decode it. Text comes out as UTF-8; images, PDFs and other binary data are detected and offered as a download. URL-safe Base64, missing padding, line breaks, data: URIs and JWTs are all accepted, and invalid input gets the exact character and position.
Encode a file:
Base64 encodes bytes, so text must first become bytes, and almost everything today uses UTF-8 for that: Python's base64.b64encode(s.encode()), PHP's base64_encode, Node's Buffer.from(s).toString('base64'). The browser's btoa() does not. Measured in Node 24 (same as Chrome):
btoa('café') returns Y2Fm6Q== (é as one Latin-1 byte), while UTF-8 gives Y2Fmw6k=. A server decoding the first one as UTF-8 gets an error or a replacement character.btoa('✓ done') throws InvalidCharacterError: any character above U+00FF (emoji, CJK, curly quotes) breaks it.atob('Y2Fmw6k='), returns café: correct UTF-8 bytes read back as Latin-1.This page always encodes and decodes text as UTF-8, so its output matches server-side code. In your own browser code, use new TextEncoder().encode(s) before Base64-encoding, or Uint8Array.prototype.toBase64() where it is available.
Standard Base64 uses + and /, which have meanings in URLs, so JWTs and many APIs use the URL-safe alphabet (RFC 4648 §5) with - and _ and no = padding. Decoders disagree on it. Decoding the URL-safe PDw_Pz8-Pg== (the bytes of <<???>>):
base64.b64decode() returns b'<<\x0f\xcf\xc3\xe0' with no error: by default it skips characters outside the standard alphabet, so the result is silently wrong. Use base64.urlsafe_b64decode(), or validate=True to get an error.base64_decode('SGVs!!bG8=') returns Hello, skipping the junk, unless you pass true as the strict flag (then it returns false).atob() throws Invalid character on both, without saying which one or where.This decoder accepts either alphabet (but not both mixed in one string, which means it was damaged), adds missing padding, skips line breaks, and names the first invalid character and its position. A string of 4n+1 characters is reported as cut off, because no valid Base64 has that length.
When the decoded bytes are not valid UTF-8 text, the result is treated as a file: its type is detected from the first bytes (PNG, JPEG, GIF, WebP, PDF, ZIP, gzip and more), images are previewed, and you can download it. A data:image/png;base64,… URI works as input too. For pictures specifically, see Base64 to image and image to Base64.
Paste a JSON Web Token (three Base64url parts joined by dots) and the header and payload are decoded as JSON, with iat, nbf and exp shown as dates and an expiry check. The signature is not verified: that needs the signing key, and a decoded token says nothing about whether it is genuine.
Shotmint is a screenshot and PDF API. POST https://shotmint.creasework.com/v1/pdf with {"html": "…"} returns a PDF, and /v1/screenshot returns a PNG of any URL or HTML, rendered in real Chromium (1 credit each; 25 free renders a month, then €5 for 2,000 that never expire). Add response=url to get a link instead of the bytes, or put the URL in a query string with the encoding above. Scripts, AI agents and Make or Zapier can get a key with a bare POST https://shotmint.creasework.com/v1/keys/free (no body, JSON reply); request bodies are described in openapi.json.
Get 25 free renders a month API docs
Is my text uploaded? No. Encoding and decoding run in your browser and nothing is sent to a server, so tokens, API keys and private data stay on your device.
Is Base64 encryption? No. Anyone can decode it; it only turns bytes into text that survives email, JSON and URLs, and makes the data about 33% bigger.
Related tools: Base64 encoder, JWT decoder, URL encoder, URL decoder, Text to hex converter, Hex to text converter, HTML encoder, HTML entity decoder, JSON formatter, Image to Base64, Base64 to image.
URL encode / decode · HTML Decode · Image to Base64 · Base64 to Image · Base64 Encode · all free tools