JSONBench

Base64, either way

Encode or decode, base64url included, full Unicode handled properly. Nothing leaves the tab.

Network measuring… Your data never leaves this tab

Encoding is not encryption

This is worth stating plainly because it is the source of genuine security incidents. Base64 has no key and no secret. Anything encoded is decodable by anyone, instantly, on a page like this one. It obscures a value from a casual glance and from nothing else.

Credentials stored base64-encoded in a config file, a database column or an environment variable are stored in plain text with extra steps. If you have found one, treat it as exposed.

Unicode, done properly

The naive browser implementation — btoa() on a string — throws on any character outside Latin-1, which means most emoji, most non-English text and even a typographic dash. The correct approach encodes the text to UTF-8 bytes first and base64s those. That is what this page does, so accented characters, CJK text and emoji all survive a round trip. The example button demonstrates it.

The rest of the bench

JWT decoderBase64url with claims parsed and expiry checkedJSON formatterValidate and pretty-printCSV ↔ JSONA real CSV parser

Questions

What is base64 for?
Carrying binary data through a channel that only reliably handles text — email attachments, data URIs in CSS, tokens in a URL, embedding a small image in HTML. It expands the data by about a third, which is the cost of only using 64 characters that survive every encoding on the way.
Is base64 encryption?
No, and this misunderstanding causes real breaches. Base64 is an encoding, not a cipher: anyone can decode it instantly, with no key, using this page. Storing a password or an API key base64-encoded provides no protection whatsoever — it only makes the value non-obvious to a human skimming a config file.
What is base64url?
A variant that swaps + and / for - and _, and usually drops the trailing = padding, so the result is safe inside a URL or filename without escaping. JWTs use it. This page accepts both forms automatically, so you do not have to know which you have.
Why does my decoded text look like nonsense?
Usually one of three things: it was not base64 to begin with, the copy was truncated, or the underlying data is genuinely binary — an image or a compressed file — rather than text. Base64 of a PNG decodes to a PNG, which is meaningless as characters.