DE EN IT

~/tools / base64-encode-decode

Base64 encode and decode

Convert text or files to Base64 and back, with UTF-8, the URL-safe alphabet and a hex dump for binary data. Everything runs in your browser.

Options

File → Base64

HTTP Basic auth header

Base64 is encoding, not encryption: anyone who sees the header knows the password. What you type here never leaves your browser.

daniele@mikweb: ~/tools — less base64-encode-decode.md

What Base64 is, and what it is not

Base64 represents arbitrary bytes with 64 printable ASCII characters (A–Z a–z 0–9 + /). Three bytes become four characters, so the data grows by about a third; a trailing = pads the result to a multiple of four characters (RFC 4648).

Base64 is not encryption. There is no key and no secret: anyone can reverse it in seconds. A password or token in Base64 is exactly as exposed as in plain text.

Where admins run into Base64

  • HTTP Basic auth: Authorization: Basic carries user:password in Base64 (RFC 7617); the helper above builds the header.
  • JWT: header and claims are Base64URL-encoded JSON; read them with the JWT decoder.
  • SAML: the SAMLResponse is Base64 (additionally compressed with the redirect binding); the SAML decoder handles that.
  • Certificates and keys: the body of a PEM file between BEGIN and END is Base64 of DER data.
  • Mail (MIME): Content-Transfer-Encoding: base64 with at most 76 characters per line.
  • Kubernetes secrets: the values under data are merely Base64, which protects nothing. On the shell: kubectl get secret NAME -o jsonpath='{.data.KEY}' | base64 -d.

Base64 vs Base64URL

Base64URL (RFC 4648 section 5) replaces + with - and / with _ so the characters are not reinterpreted in URLs and file names. Padding is often left out there, as in JWTs. When decoding, this tool accepts both alphabets, ignores spaces and line breaks and copes with missing padding. When encoding, pick the alphabet with the option.

Common mistakes and questions

  • Trailing newline in the plain text: echo foo | base64 also encodes the newline (Zm9vCg== instead of Zm9v). Use echo -n or printf.
  • Wrong character set: “ä” is w6Q= in UTF-8 but 5A== in Latin-1. This tool uses UTF-8.
  • Encoded twice: if the decoded result again looks like Base64 (often starting ZX… or eyJ…), it was encoded twice.
  • Wrong length: a remainder of 1 when dividing by 4 means something is missing; missing padding, by contrast, is usually harmless.
  • Line breaks from mail or PEM do not matter here; with base64 -d on the shell they may need -i or tr -d '\n', depending on the version.
  • Can I paste passwords here? Processing happens locally in your browser and no network request is made. Still, only type real credentials on devices you trust.

Privacy

Runs entirely in your browser; nothing is sent or stored.

daniele@mikweb: ~/blog — ls

Related articles

Nextcloud with SAML and OIDC: 8 errors that keep showing up in supportRedirect loop, clock skew, wrong UID, duplicate accounts, missing groups: 8 SAML/OIDC errors from Nextcloud support — each with the cause and the fix.
daniele@mikweb: ~/tools — ls

Tools

SPF checkerCounts the DNS lookups of your SPF record (limit: 10).DNS TTL plannerPlans the TTL reduction and the move time.Cron explainerExplains cron expressions and shows the next runs.DMARC generatorBuilds a valid DMARC record to copy.Mail DNS checkChecks MX, reverse DNS, SPF, DMARC and MTA-STS of a domain.Certificate checkExpiry, chain and names of a TLS certificate.Security headersGrades HSTS, CSP and other security headers.JWT decoderShows header, claims and expiry of a JWT — in your browser only.SAML decoderDecodes SAML responses and spots typical errors.nginx for NextcloudGenerates an nginx config for Nextcloud with PHP-FPM.Explain an errorPaste an error — meaning, causes and checks (AI).chmod calculatorFile permissions octal ↔ symbolic, ready chmod commands and umask — in your browser only.Subnet calculatorWorks out CIDR, netmask, wildcard and hosts for IPv4 and IPv6 and splits networks into subnets.Redirect generatorGenerates redirects for nginx and Apache (.htaccess) with a curl test.

← Tools