URL-safe Base64 encoder
Encode and decode URL-safe Base64 (RFC 4648 §5): -_ instead of +/, no padding. Handles emoji and every other character atob() refuses outright.
Why URLs need their own Base64
Standard Base64 uses +, / and =. All three are hostile to a URL: + decodes to a space in a query string, / splits a path, and = is a sub-delimiter. RFC 4648 §5 defines a URL-safe alphabet that swaps +/ for -_, and padding is usually dropped because the length is recoverable without it.
This is the encoding used by JWTs, by data: URLs in query parameters, and by anything that has to survive being pasted into a browser bar.
What btoa gets wrong
The browser's btoa is byte-oriented and throws outright on any character above U+00FF — so the first accented letter or emoji anyone tries fails with "The string to be encoded contains characters outside of the Latin1 range". This tool encodes UTF-8 first, so any text works.
Decoding is the mirror image: bytes that are not valid UTF-8 are reported as an error rather than returned as a string full of replacement characters, because silently mangling what you round-trip is worse than saying the payload was not text.
Base64 is not encryption
It is an encoding. Anything you encode here can be read by anyone who has the string. It hides nothing.
Related tools
- URL encoder and decoderPercent-encode and decode text, with the component-vs-full-URI distinction made explicit — the difference that decides whether your slashes and ampersands survive.
- URL parser and validatorBreak a URL into scheme, host, port, path, query and fragment, and see why an invalid one is invalid. Handles IDN hosts, repeated parameters and odd schemes.
- Slug generatorTurn a title into a clean URL slug. Accents decompose, ß becomes ss, & becomes and, and you choose the separator, the length cap and whether to keep Unicode.