Base64 Encoder / Decoder

This tool converts text into Base64 (encode) or converts Base64 back into readable text (decode). It uses TextEncoder and TextDecoder internally so multi-byte characters such as emoji or non-Latin scripts survive the round trip correctly instead of becoming garbled.

Base64 shows up everywhere in security investigations: encoded PowerShell commands in malware, data URIs hiding payloads in HTML, JWT tokens, and email attachments. Being able to quickly decode a Base64 blob during log review or phishing triage is a routine part of analyst work.

Base64 represents every 3 bytes of binary data as 4 printable characters from a 64-character alphabet, padded with = when needed. Encoding here uses the browser's btoa after converting text to UTF-8 bytes; decoding reverses that with atob and TextDecoder. Invalid input -- wrong characters, broken padding -- throws an error, which this tool surfaces as a friendly message instead of silently producing garbage.

1. 1Choose Encode or Decode.
2. 2Paste or type your text or Base64 string into the input box.
3. 3Read the result as it updates automatically.
4. 4Use Swap to feed the result back in and flip direction, or Copy to grab the output.

Decoding the payload segment of a suspicious data URI found in an email to see what content it actually embeds. Decoding the value of an HTTP Basic Authentication header captured in a proxy log to reveal the (unencrypted) username and password it contains. Encoding a binary snippet so it can be embedded safely inside a JSON field or URL.

• Assuming Base64 hides or protects sensitive data -- it provides no confidentiality at all.
• Forgetting padding characters (=) when manually constructing Base64 strings.
• Mixing up URL-safe Base64 (using - and _ instead of + and /) with standard Base64.
• Trying to decode text that has already been through another encoding step, such as URL encoding.

Because Base64 is trivially reversible, never rely on it to protect secrets -- always use real encryption for confidentiality. When investigating suspicious content, decoding Base64 is generally safe as an inspection step, but be cautious about executing or opening whatever the decoded content turns out to be, especially scripts or documents from an untrusted source.