Base64 Encoder & Decoder

Understand the bytes behind Base64

Base64 carries binary bytes through systems designed for text. This converter encodes text as UTF-8 bytes and decodes Base64 back into UTF-8 text. It does not upload files, render images, decrypt secrets, or verify signatures. A PNG, ZIP archive, or certificate can be valid Base64 while failing this text decoder because its bytes are not a UTF-8 message. Use a binary-aware local tool for those formats.

Encoding mathematics and storage overhead

The encoder groups three input bytes into 24 bits and divides them into four six-bit values. Each value selects a character from a 64-character alphabet. Standard Base64 uses uppercase letters, lowercase letters, digits, plus, and slash. Equals signs pad the final group when the input length is not divisible by three. Padding conveys the final byte count; it is not encrypted information.

For n input bytes, padded output length is 4 × ceil(n / 3). One byte becomes four characters, three bytes become four, and 1,024 bytes become 1,368 characters. For large inputs the expansion approaches one third, before any JSON wrapping or network compression. Count UTF-8 bytes rather than JavaScript string length when estimating payload size: an emoji can occupy four bytes although it appears as one visible symbol.

Try the text hello: its standard encoding is aGVsbG8=. Add a newline and the result changes because the input bytes changed. This matters when comparing credentials copied from terminals or fixtures copied from documentation. Keep whitespace inside the original text when it is meaningful; remove transport line wrapping from encoded data only when the protocol permits it. Always compare decoded bytes when diagnosing an interoperability problem.

Android interoperability and Base64url

On Android, explicitly select UTF-8 when converting text to bytes and choose Base64 flags to match the receiving API. android.util.Base64.NO_WRAP avoids inserted line breaks. URL_SAFE uses minus and underscore instead of plus and slash; NO_PADDING is a separate decision. A server expecting standard padded Base64 may reject a URL-safe token. This page's decoder expects the standard alphabet; do not treat an unsupported alphabet as evidence that the original token is corrupt.

val bytes = message.toByteArray(Charsets.UTF_8)
val encoded = android.util.Base64.encodeToString(
    bytes, android.util.Base64.NO_WRAP
)
val restored = String(
    android.util.Base64.decode(encoded, android.util.Base64.DEFAULT),
    Charsets.UTF_8
)

A data URI has a media type and a comma before the encoded payload, for example data:text/plain;base64,aGVsbG8=. Paste only the part after the comma here. JWT segments use Base64url and need a JWT-aware decoder; reading their contents does not validate a signature or establish that their claims are true. Avoid logging authentication headers or full tokens during debugging.

Encoding, hashing, and encryption are different

Anyone with a Base64 string can recover its bytes. It offers no confidentiality, password protection, or integrity guarantee. Encryption requires a key; a cryptographic hash produces a fixed-length digest. For an ideal n-bit hash, generic collision searching takes about 2^(n/2) work, whereas finding an input for a particular digest takes about 2^n. SHA-256 therefore targets approximately 128-bit generic collision resistance. Base64 has no comparable security property.

Use HTTPS for transport and platform-backed key storage where appropriate. Do not store a password as Base64 or as a single unsalted SHA-256 digest. Server-side password storage needs a purpose-built password hashing scheme with an appropriate work factor. For authenticated messages use a vetted MAC or signature design; changing a Base64 character can change the decoded message without alerting the recipient.

Certificate fingerprints are not Base64 secrets

Android service setup often asks for a SHA-1 or SHA-256 certificate fingerprint. A PEM certificate wraps DER certificate bytes in Base64, but hashing that displayed text produces a different value from hashing the certificate bytes. Use keytool to inspect the certificate directly. Run this command locally, replace the path and alias, and enter the keystore password at the prompt rather than placing it in shell history:

keytool -list -v -keystore release.jks -alias release

Read the SHA1 and SHA256 fingerprint fields and compare the algorithm requested by your service. A debug certificate, upload certificate, and Play app signing certificate can all differ. For an installed Play-distributed build, consult the app signing certificate in Play Console. Share only the public fingerprint when registering an integration; never paste the keystore or private key into an online converter.

Technical references

See RFC 4648, the Android Base64 API, and the Android app signing guide.

Frequently asked questions

Published by AndroidRich. Technical content updated 4 October 2026. Report a correction.