Type text or open a file to get its Base64. Text is encoded as UTF-8, so accents, emoji and non-Latin scripts give the same result as Python, PHP and Node. Choose standard, URL-safe (for URLs and JWTs) or 76-character MIME lines.
Encode a file:
Base64 encodes bytes, so text must first become bytes, and almost everything today uses UTF-8 for that: Python's base64.b64encode(s.encode()), PHP's base64_encode, Node's Buffer.from(s).toString('base64'). The browser's btoa() does not. Measured in Node 24 (same as Chrome):
btoa('café') returns Y2Fm6Q== (é as one Latin-1 byte), while UTF-8 gives Y2Fmw6k=. A server decoding the first one as UTF-8 gets an error or a replacement character.btoa('✓ done') throws InvalidCharacterError: any character above U+00FF (emoji, CJK, curly quotes) breaks it.atob('Y2Fmw6k='), returns café: correct UTF-8 bytes read back as Latin-1.This page always encodes and decodes text as UTF-8, so its output matches server-side code. In your own browser code, use new TextEncoder().encode(s) before Base64-encoding, or Uint8Array.prototype.toBase64() where it is available.
Standard Base64 uses + and /, which have meanings in URLs, so JWTs and many APIs use the URL-safe alphabet (RFC 4648 §5) with - and _ and no = padding. Decoders disagree on it. Decoding the URL-safe PDw_Pz8-Pg== (the bytes of <<???>>):
base64.b64decode() returns b'<<\x0f\xcf\xc3\xe0' with no error: by default it skips characters outside the standard alphabet, so the result is silently wrong. Use base64.urlsafe_b64decode(), or validate=True to get an error.base64_decode('SGVs!!bG8=') returns Hello, skipping the junk, unless you pass true as the strict flag (then it returns false).atob() throws Invalid character on both, without saying which one or where.This decoder accepts either alphabet (but not both mixed in one string, which means it was damaged), adds missing padding, skips line breaks, and names the first invalid character and its position. A string of 4n+1 characters is reported as cut off, because no valid Base64 has that length.
When the decoded bytes are not valid UTF-8 text, the result is treated as a file: its type is detected from the first bytes (PNG, JPEG, GIF, WebP, PDF, ZIP, gzip and more), images are previewed, and you can download it. A data:image/png;base64,… URI works as input too. For pictures specifically, see Base64 to image and image to Base64.
Paste a JSON Web Token (three Base64url parts joined by dots) and the header and payload are decoded as JSON, with iat, nbf and exp shown as dates and an expiry check. The signature is not verified: that needs the signing key, and a decoded token says nothing about whether it is genuine.
Shotmint is a screenshot and PDF API. POST https://shotmint.creasework.com/v1/pdf with {"html": "…"} returns a PDF, and /v1/screenshot returns a PNG of any URL or HTML, rendered in real Chromium (1 credit each; 25 free renders a month, then €5 for 2,000 that never expire). Add response=url to get a link instead of the bytes, or put the URL in a query string with the encoding above. Scripts, AI agents and Make or Zapier can get a key with a bare POST https://shotmint.creasework.com/v1/keys/free (no body, JSON reply); request bodies are described in openapi.json.
Get 25 free renders a month API docs
Is my text uploaded? No. Encoding and decoding run in your browser and nothing is sent to a server, so tokens, API keys and private data stay on your device.
Is Base64 encryption? No. Anyone can decode it; it only turns bytes into text that survives email, JSON and URLs, and makes the data about 33% bigger.
Related tools: Base64 decoder, JWT decoder, URL encoder, URL decoder, Text to hex converter, Hex to text converter, HTML encoder, HTML entity decoder, JSON formatter, Image to Base64, Base64 to image.
HTML Encode · URL Encode · Base64 to Image · Image to Base64 · Base64 encode / decode · all free tools