Base64 is encoding, not encryption. It hides nothing from anyone who looks. Its purpose is to carry arbitrary bytes through channels that only accept text — headers, JSON, URLs, email.
Which variant
Base64 uses + and /, with = padding. Both + and / have meaning in URLs, so a Base64 value in a query string gets mangled: + becomes a space.
Base64URL replaces +/ with -_ and usually drops the padding. This is what JWTs use, and what you want for anything that travels in a URL, a filename or a header.
Base32 uses 32 uppercase characters, no lowercase, no ambiguous glyphs. Less dense — 5 bits per character against Base64's 6 — but survives case-insensitive systems and human transcription. TOTP secrets use it for this reason.
Base58 drops 0, O, I and l entirely. Designed for values a human might copy by hand.
The hex dump
The dump is the most useful panel here. It shows the actual bytes with an ASCII column, which makes visible the things that cause "the value looks right but does not work":
- A trailing
0a— a newline your editor added. - A leading
ef bb bf— a UTF-8 byte order mark, common in files saved by Windows tools. - A
20where you expected nothing — a stray space from a copy-paste. - A value shorter than expected — silent truncation by a fixed-width database column.
The `+` becomes space problem
A Base64 value placed in a URL query string without further encoding will have its + characters decoded as spaces by the receiving server. The value then fails to decode, or decodes to different bytes.
Two fixes: use Base64URL, or percent-encode the Base64 before putting it in the URL. Base64URL is cleaner. The URL encoder handles the second case.
Padding
The = characters pad the output to a multiple of four. Most decoders tolerate its absence; some do not. Base64URL conventionally omits it, and JWT explicitly forbids it. If a decoder rejects your value, try adding padding to a multiple of four.
Frequently asked questions
Is Base64 encryption?
No. It is a reversible transformation with no key. Anyone can decode it instantly, as this page demonstrates. Encoding a secret in Base64 to "hide" it provides no security whatsoever.
Why does my Base64 have a newline every 64 characters?
Some tools — notably openssl base64 and PEM encoding — wrap output at 64 or 76 characters. Most decoders strip whitespace; some do not. This tool strips it.
What is the size overhead?
Base64 is 4 characters per 3 bytes, so about 33% larger. Base32 is 8 characters per 5 bytes, about 60% larger. Hex doubles the size. Choose based on what the channel requires, not on size alone.
Can I decode a JWT here?
You can decode its segments individually with Base64URL, but the JWT decoder parses all three parts, resolves the timestamps and verifies the signature.