Base64 Encoder, Decoder & Inspector
Encode any file — not just images — with the alphabet, padding and line width the consumer actually expects. Decode a payload and see what it really is: the format read from its magic bytes, the first bytes in hex, its gzipped size and its SHA-256.
How it works
Bring the payload in
Type it, paste it, drop a file of any type, or let another tool in the suite hand it over. Dropping a file reads nothing yet.
Choose how it comes out
Standard or URL-safe alphabet, padding on or off, wrapped at 64, 76 or 100 columns with LF or CRLF. The choices are the ones real parsers disagree about.
Look at the bytes
The format is read from the magic numbers, not guessed from the name. You get the hex dump, the gzipped size, the SHA-256 and a reversibility check.
Take it away
Copy the raw string, a data URL, a CSS rule, an img tag, a JSON body or a PEM block — or send the decoded file straight to another tool.
Three bytes, four characters
Base64 always costs 33% more than the bytes it carries, and the tool shows both numbers plus the gzipped size, because on text-like payloads gzip claws most of that back and on a PNG it claws back almost none.
URL-safe alphabet
Switch to - and _ and the payload survives a query string, a filename or a JWT with nothing to escape. Padding can be dropped too, which is what token formats expect.
Hex inspector
See the actual bytes, sixteen to a line, with the printable ASCII beside them. The magic number is highlighted, so a truncated file gives itself away immediately.
It tells you what broke
Which character is not in the alphabet and at what offset, whether padding was missing, whether the final character carries bits that get thrown away. Not a bare "invalid Base64".
Format read from the bytes
PNG, JPEG, GIF, WebP, AVIF, HEIC, PDF, ZIP and the Office formats inside it, WOFF2, MP4, WASM, SQLite and more, identified by signature — so the download gets the right extension.
Big files stay smooth
Files are consumed in 3 MB blocks on a worker thread, with a real progress bar and a working Stop button. The tab keeps responding while a 200 MB payload is converted.
Measurable, not just produced
Gzipped size and SHA-256 come with every run, computed on the same bytes. That is how you decide whether embedding beats a second request, and how you prove the round trip was lossless.
Reversibility check
Every text encode is immediately decoded again and compared byte for byte, so an alphabet and padding combination that your consumer would reject is flagged before you paste it.
The payload, not just the string
Most Base64 tools hand you a string and stop. This one keeps the bytes: it identifies the format from its signature, dumps the first kilobyte in hex, measures what the payload really costs after gzip, hashes it so you can prove the round trip, and tells you precisely which character at which offset broke a payload instead of blaming the whole thing. Encoding accepts any file — a font, a PDF, a WebAssembly module — because Base64 was never only about images.
Nothing leaves your browser
Encoding, decoding, format detection, the hex dump, the gzip measurement and the SHA-256 are all native browser APIs running in your own tab, on a worker thread for anything large. There is no upload, no request and nothing to log — which matters, because the payloads people paste into a Base64 tool are routinely private keys, session tokens and internal documents.
Built for the payloads that arrive without a label
A blob out of a database column with no MIME type recorded anywhere. A JWT segment that will not decode because it uses the URL-safe alphabet and has no padding. An inline SVG in a stylesheet that renders as a broken image. A data URL that claims image/png while the bytes are plainly a JPEG. A certificate wrapped at 64 columns that a strict parser refuses. Base64Bolt reads all of them, says what the bytes actually are, and lets you take the result out as a file with the right extension.
There is no sign-up, no daily quota and no paid tier hiding the useful half of the tool. Files you open are read locally and never transmitted; the tab forgets everything when you close it.
Frequently Asked Questions
QWhy does my JWT or token fail to decode elsewhere but work here?+
Because it uses the URL-safe alphabet — hyphen and underscore instead of plus and slash — and usually has its padding stripped. A decoder that only knows the standard alphabet throws on the first hyphen. Base64Bolt detects which alphabet the input uses, restores the missing padding, and tells you it did both.
QDoes Base64 make my file bigger?+
Always, by exactly one third: every three bytes become four characters, plus up to two padding characters. Whether that costs you anything depends on compression, which is why the tool shows the gzipped size next to the raw one. Embedding a small SVG usually wins; embedding a large JPEG usually loses, because it is already compressed and Base64 undoes some of that.
QCan I encode something that is not an image?+
Yes, any file. Fonts for an @font-face rule, a PDF for a download link, a WebAssembly module, a ZIP, an audio clip. The old limitation to images was arbitrary — Base64 does not care what the bytes mean.
QWhat does "the final character carries bits that get discarded" mean?+
Each Base64 character holds six bits, but the last group of a payload often needs fewer. QQ== and QR== both decode to the single byte 0x41, because the last four bits of R are thrown away. No encoder produces the second form, so seeing it means the string was truncated or edited by hand — worth knowing before you trust the result.
QWhy did decoding say the bytes are not UTF-8?+
Because they are not text. Base64 carries bytes, and plenty of payloads are images, archives or keys. The old behaviour was to report "invalid Base64", which was simply wrong: the Base64 was fine. Switch to the Base64-to-file tab and the tool will identify the format and let you download it.
QShould I wrap the output at 76 columns?+
Only if something downstream expects it. MIME bodies and PEM blocks are line-wrapped by specification — PEM at 64 columns, MIME at 76 — and some mail parsers reject a single enormous line. For a data URL in a stylesheet or a JSON field, leave wrapping off.
QIs anything sent to a server?+
No. Every step is a native browser API running in your tab, so the tool keeps working offline once the page has loaded. Nothing is uploaded, cached remotely or logged.