How to Encode and Decode Base64 (Without a Server)

That is the entire product promise of a local encoder. DevOkk’s Base64 Encoder encode/decode in the browser so the bytes - a key material leftover, a customer export fragment, a data URL - do not need to visit a converter you cannot name.

What Base64 is actually for

Text protocols are bad at raw bytes. A PNG, a protobuf, a random 32-byte key, a PDF page - none of those survive a JSON string without an escaping story. Base64 is the boring story: map every 3 bytes to 4 characters from A–Z, a–z, 0–9, +, /, and pad with = so the length works out.

You will meet it in:

• Data URLs. data:image/png;base64,iVBOR… in CSS or markdown.
• HTTP basic auth. Authorization: Basic plus base64(user:pass). Still a password in transit if you skip HTTPS.
• JSON APIs. Binary fields encoded as strings.
• Email (MIME). Attachments predating everyone speaking JSON.
• JWTs. Same idea, URL-safe alphabet. Use a JWT tool for those, not a generic box.

If your job is “make this JSON pretty,” you are in the wrong article. If your job is “this string looks like noise and I need the original text,” you are in the right one.

Base64 is not encryption

Write it on a sticky note if you have to. Encoding is a change of representation. Encryption is access control with a key.

SGVsbG8= is Hello. There is no passphrase. Search results that say “Base64 encrypt online” are describing the same transform with the wrong verb. Treating encoded credentials as “obfuscated” is how keys end up in frontend bundles with a comment that says // encoded so it's safe.

If you need confidentiality, use a real cipher and a key you do not ship next to the ciphertext. If you need integrity, use a hash or a signature - see MD5 vs SHA-1 vs SHA-256. Base64 does neither.

The reason to encode locally is the content, not a fantasy that the algorithm protects you. A password inside Base64 is still a password. Decode it on a machine you control.

Data URLs, tokens, and the wrong tool

Data URLs. Fine for a 2 KB icon. Painful for a hero image. Browsers download the whole string with the HTML. Encode the file in the tab, prefix the MIME type, paste. Then ask whether <img src="/icon.png"> would have been simpler.

Opaque tokens that are not JWTs. Session blobs and some API keys are raw Base64. Decode to see if they are JSON, a UUID, or more binary. If you get UTF-8 text, you learned something. If you get noise, it might be encrypted or just binary. Do not assume noise means “secure.”

JWTs. Three dots, Base64url, JSON in the first two parts. Open JWT Decoder. A generic Base64 decoder will choke on -/_ or on the fact that you pasted all three segments as one string. Decode is still not verify. Read What Is a JWT? if that is the actual task.

Query strings. %2F and + are URL encoding, not Base64. Use URL Decoder.

Encode and decode in the tab

1. Open Base64 Encoder. No account.
2. Paste the text or the encoded string. Encode or decode. Copy the result.
3. If the output is JSON, format it in a JSON tool as a second step. If it is a JWT, switch tools.
4. If the output is binary garbage in the textarea, you probably had the wrong variant (URL-safe vs standard), missing padding, or a truncated copy from an email that wrapped lines.
5. Close the tab if the bytes were sensitive. Do not paste the decoded key into a ticket.

Whitespace: many decoders ignore newlines (MIME). Some do not. If a paste from an email fails, strip wrapping first.

UTF-8: modern tools encode text as UTF-8 then Base64. A string that was encoded as Latin-1 will decode to mojibake. The encoder is not wrong; the original encoding was.

Padding, URL-safe variants, and size

Standard Base64 length is a multiple of 4. Padding = makes that true. Some libraries omit padding. If decode fails, try adding = until the length divides by 4 (one or two equals, not three).

Base64url swaps + → - and / → _ so the string can sit in a URL or a JWT segment. If you see those characters, you need a URL-safe decoder or a JWT decoder. Feeding URL-safe input to a strict standard decoder is a common “it works in one tool” failure.

Size: 3 bytes → 4 characters. A 300 KB file becomes about 400 KB of text. That is expected. It is not compression. If you needed a smaller file, compress the bytes first, then encode - or do not encode at all and send the file.

Mistakes that waste an afternoon

Calling the output “encrypted” in a PR description. Reviewers will believe you.

Double-encoding. Base64 of Base64 of a password is still not a secret, and now two people have to know how many times to decode.

Pasting a live production key into a random “online Base64” because the first result had ads. Use a local tool or base64 in a terminal you already trust.

Treating decode success as “this is a safe string to put in HTML.” Base64 can carry a script as easily as a PNG. Encoding is not sanitizing. HTML entities are a different transform; see the XSS article in this cluster if that is the next problem.

Pick Base64, a JWT, or a percent-encoded URL

If the string is generic Base64, use Base64 Encoder. If it has two dots and looks like eyJ…, use JWT Decoder. If it is full of %20 and +, use URL Decoder.

Do not upload a private file to “convert it to Base64” on a site you found ten seconds ago. The algorithm does not require a server. The privacy problem is the extra copy.