Base64 decode and encode text

How Base64 works, in one minute

Base64 writes any bytes using only 64 safe characters: A to Z, a to z, 0 to 9, + and /. It takes the input three bytes at a time. Those 24 bits are cut into four groups of 6 bits, and each group picks one of the 64 characters. Three bytes in, four characters out.

So Base64 is always about a third bigger than what it encodes: 300 bytes become 400 characters. When the input does not divide by three, the end is padded with = signs. "Hi!" encodes to SGkh, "Hi" to SGk= and "H" to SA==.

Text has to become bytes first, and Octoolo uses UTF-8, the encoding the web runs on. An English letter is one byte, é is two (w6k= in Base64) and most emoji are four, so two texts of the same length can give Base64 of different lengths.

One thing Base64 is not: encryption. There is no key. Anyone can decode it, which is exactly why a decoder is handy, and why a secret "hidden" in Base64 is not hidden at all.

Standard and URL-safe Base64

Two of the standard alphabet's characters cause trouble outside email. In a URL query, + is read as a space, and / separates folders in paths and file names. The URL-safe variant, called base64url, swaps them: - instead of +, and _ instead of /. It usually leaves off the = padding as well, because = has a job in query strings too.

When encoding, URL-safe alphabet makes the swap and drops the padding. When decoding there is nothing to choose: Octoolo reads both alphabets, skips spaces and line breaks (such as the 76-character lines of email), and adds back any padding that was cut off.

Where you meet Base64, and what decoding shows

• Authorization headers. HTTP Basic auth sends the user name and password as the Base64 of user:password. dXNlcjpwYXNz decodes to user:pass, which is why Basic auth is only safe over HTTPS.
• Kubernetes Secrets. Secret values are stored Base64-encoded, not encrypted. Decoding one shows the real value.
• JWTs. Each part of a token is base64url. The JWT decoder splits the token and decodes all of it for you, dates included.
• Email source. A message part sent with Content-Transfer-Encoding: base64 can be pasted in, as long as its text is UTF-8.
• Data URLs in HTML and CSS, such as data:image/svg+xml;base64,PHN2Zy... Delete everything up to and including the comma, and an SVG decodes back to its markup.

Decoding works on your own machine, which is what you want when the string is a credential pulled from a header, a cluster or a log.

Text only: what to use for files

This tool decodes to text. If the Base64 holds a picture, a PDF, a ZIP or a certificate's binary DER data, the bytes are not valid UTF-8 text and you see "This is not Base64 text, or it does not decode to text." The same message appears when the input contains characters from neither alphabet, such as a stray quote or a data: prefix.

For files, Windows has two built-in ways:

• certutil in Command Prompt: certutil -encode photo.jpg photo.txt turns a file into Base64, and certutil -decode photo.txt photo.jpg turns it back. The encoded file gets BEGIN and END lines added around the Base64.
• PowerShell: [Convert]::ToBase64String([IO.File]::ReadAllBytes("C:\Temp\photo.jpg")) prints a file's Base64, and [IO.File]::WriteAllBytes with [Convert]::FromBase64String writes decoded bytes back to a file.

To check that a downloaded file is the one it claims to be, compare hashes rather than Base64: see the SHA-256 hash generator.