Base64 Encoder / Decoder
Why use a private Base64 encoder?
Base64 is commonly used to encode credentials, API keys, binary files, and authentication headers. Online Base64 encoders that process your data server-side can log the plaintext content — the exact thing you are trying to encode.
formatvault encodes and decodes Base64 using the browser's native APIs and the unicode-safe js-base64 library. Nothing is transmitted. The output appears instantly as you type.
How it works
Standard Base64 uses the characters A–Z a–z 0–9 + / with = padding. URL-safe Base64 replaces + with - and / with _, making it safe for use in URLs and filenames. The encoder auto-detects whether your input looks like Base64 and switches to decode mode automatically.
Full Unicode support means emoji, accented characters, and non-Latin scripts are encoded correctly — unlike btoa(), which fails on multi-byte characters.
Common use cases
- Encoding HTTP Basic Auth credentials (username:password) for Authorization headers
- Decoding base64-encoded JWT payloads or SAML assertions
- Encoding binary file content (images, PDFs) for embedding in JSON or HTML
- Decoding base64-encoded environment variables stored in CI/CD systems
- Encoding API keys or secrets before storing them in config files
- Converting base64-encoded email attachments for inspection
- Verifying that a base64 string round-trips correctly before embedding in code
Frequently asked questions
- Is it safe to encode credentials or API keys here?
- Yes. All encoding and decoding happens in your browser using native APIs — nothing is transmitted to any server. This makes it safe for encoding sensitive strings that you would not normally share.
- What is the difference between standard and URL-safe Base64?
- Standard Base64 uses + and / which have special meaning in URLs. URL-safe Base64 replaces them with - and _ respectively, making the output safe to include in URLs, filenames, and HTTP headers without percent-encoding.
- Why does btoa() fail on my string but this tool works?
- JavaScript's built-in btoa() only handles Latin-1 characters. formatvault uses js-base64 which correctly handles the full Unicode character set including emoji and multi-byte characters.
- How does auto-detect mode work?
- The tool inspects your input and checks whether it matches the Base64 character set and length rules. If it looks like Base64, it switches to decode mode. You can override this manually.