LocalOps Studio free browser tools

How-to guide · BaseKit

How to encode and decode Base64 safely

Base64 turns binary data into ASCII for transport - email attachments, JWT segments, data URLs, and API tokens. The tools people use for it online are often ASCII-only and silently corrupt non-Latin text. This guide covers UTF-8-safe encoding, URL-safe output, and why the operation belongs in your browser.

Updated 2026-08-25 Local-first No upload

The UTF-8 failure most converters hide

Plain Base64 only covers ASCII. Encode 中文 or an emoji with an ASCII-only converter and the output decodes to mojibake later. A UTF-8-safe codec encodes the text's UTF-8 bytes first, so multibyte characters survive the round trip exactly - matching what Node, Python, and Go do with their standard libraries.

Test it: encode 中文, decode the result, and if you get 中文 back, the tool is UTF-8-safe.

Standard Base64 vs URL-safe Base64

  • Standard Base64 uses + and / and = padding - fine in bodies, wrong in URLs.
  • URL-safe Base64 swaps + for - and / for _, and drops the = padding.
  • JWT header and payload segments and many API tokens use URL-safe output.
  • Pick URL-safe whenever the string will live in a query string, header, or filename.

Keep the decode local when it could be a secret

People routinely base64-decode JWT segments and API tokens to inspect them. Paste those into an online decoder and you have handed the vendor your token. A local decoder runs in your browser and the input never leaves your machine.

The same privacy rule applies to encoded customer data and anything copied out of logs.

A safe encode/decode workflow

  1. Open a UTF-8-safe Base64 tool (BaseKit runs locally in your browser).
  2. Paste plain text to encode, or Base64 to decode.
  3. Toggle URL-safe for tokens and query parameters.
  4. Copy the result, or use swap to flip the two panes for the reverse direction.
Try it free - BaseKit

Encode and decode Base64 with UTF-8

Open the tool

Frequently asked questions

Why does my decoded text show gibberish for Chinese characters?

The converter was ASCII-only. It encoded the bytes wrong instead of encoding UTF-8 first. Use a UTF-8-safe tool and 中文 round-trips correctly.

What is the difference between base64 and URL-safe base64?

URL-safe replaces + and / with - and _, and removes = padding, so the string is safe inside URLs and query strings. It is the format used by JWTs.

Can Base64 encode images?

Base64 encodes any bytes, so yes - images become data URLs. This tool handles text; for images you typically want a tool that reads the file directly.

Is it safe to decode a JWT online?

A JWT payload may be readable without a key, but pasting it into an online decoder sends your token to that vendor. Decode it locally instead.