Base64 & URL encoder

Why so many Base64 tools break on Urdu

The browser's built-in is btoa, and it does not take text. It takes a string of characters each of which must fit in one byte — Latin-1. Two things go wrong:

• It throws on anything above U+00FF. Arabic, Urdu, Hindi, Chinese, an emoji — "The string to be encoded contains characters outside of the Latin1 range". Loud, at least.
• It silently lies for characters that do fit in Latin-1. btoa("café") returns Y2Fm6Q==. The correct UTF-8 answer is Y2Fmw6k=. No error, no warning, a different string — and whatever decodes it as UTF-8 later gets mojibake. This is the worse failure, because nothing tells you.

The fix is one step: turn the text into UTF-8 bytes first, then Base64 the bytes. That is what every other system means by "Base64 of this string", and it is what this page does. Round-trip anything above — Urdu, an emoji, an accent — and it comes back exactly as it went in.

Decoding has a matching trap. A decoder that meets invalid UTF-8 usually substitutes replacement characters, so a wrong answer looks like a right one. This one reports the failure instead — if the Base64 holds an image rather than text, it says so.

Base64 is not encryption

Worth saying plainly, because it is a real and recurring mistake. Base64 is an encoding. There is no key. Anyone can reverse it instantly, including on this page, and every browser can do it in one line. It exists so that arbitrary bytes can travel through channels that only expect text — email attachments, data URLs, JSON fields.

Which means: a password stored Base64-encoded is a password stored in plain text with extra steps, and a token in a URL is readable by anyone who sees the URL, including every proxy and log along the way. The middle segment of a JWT is Base64 and is meant to be readable — the signature is what makes it trustworthy, not the encoding.

One more consequence: Base64 always makes things bigger, by about a third. Three bytes become four characters. That is the cost of passing through a text-only channel, and it is why inlining a large image as a data URL is usually a false economy.

encodeURI or encodeURIComponent?

The distinction that causes real bugs, so both are here as separate modes.

URL component — encodeURIComponent — escapes everything unsafe inside one piece of a URL, including /, ?, &, = and #. Use it for a value you are putting into a query string or a path segment.

Whole URL — encodeURI — assumes you have handed it an entire URL and leaves those characters alone, because there they are structure rather than data.

The bug is using the second where you needed the first. A search value containing & passed through encodeURI stays a literal &, and the server reads one parameter as two. If you are building a query string, it is always encodeURIComponent — and if you are not sure which you are doing, you are building a query string.

Questions

Why does Base64 break on accents and emoji?

Because btoa, the browser's built-in, works on Latin-1 bytes rather than text. Give it a character above U+00FF such as an emoji or Arabic and it throws. Give it an accented Latin-1 character such as é and it does something worse: it succeeds and returns the Latin-1 encoding, so btoa of café is Y2Fm6Q== where the correct UTF-8 answer is Y2Fmw6k=. No error, a different string, and mojibake at the far end. The fix is to encode the text to UTF-8 bytes first.

Why did another tool give me a different Base64?

Almost certainly because it used btoa on Latin-1 rather than encoding to UTF-8 first. For plain English both agree; the moment there is an accent they diverge, silently.

Can I hide a password with Base64?

No, and this matters. Base64 is an encoding, not a cipher — anyone can decode it instantly with no key, including on this page. It exists to carry bytes safely through channels that expect text. Never use it to hide a password, a token or anything else you would not print on the page.

What is URL-safe Base64?

The same encoding with two characters swapped: + becomes - and / becomes _, and the trailing = padding is usually dropped. Those three characters have meaning inside a URL, so the standard alphabet breaks when pasted into one. It is what JWTs use, which is why a JWT's segments decode here whether or not the URL-safe box is ticked.

What is the difference between encodeURI and encodeURIComponent?

encodeURIComponent escapes everything that is not safe inside one piece of a URL, including / ? & = and #. encodeURI assumes you are handing it a whole URL and leaves those alone, because there they are structure rather than data. Use encodeURIComponent for a value you are putting into a query string; using encodeURI there is the bug that lets an & inside a value split it into two parameters.

Why is my output longer than the input?

Base64 turns every three bytes into four characters, so it costs about a third more. That is inherent, not a setting.

Is my text uploaded?

No. It runs in your browser — which matters, because the strings people decode here are very often tokens.

More tools

• Number base converterBinary, octal, decimal, hex and any base to 36 — in BigInt, so a 64-bit id converts exactly instead of quietly losing its last digit the way parseInt does.
• Colour contrast checkerThe ratio, the AA and AAA verdicts, HEX/RGB/HSL conversion — and the nearest shade of your own colour that passes, so a failure arrives with a fix.
• JSON formatterFormat, minify and validate — and when it breaks, the exact line, column and caret, because browsers do not give a position for the mistakes people actually make.
• QR code generatorA static QR code — the link lives in the pattern, not on somebody's redirect. Nothing expires, no scans are counted, and nobody can change where it points after you have printed it.
• Age calculatorExact age in years, months and days — worked out on the calendar rather than by dividing by 365 — with the Hijri date and the next birthday.
• BMI calculatorYour BMI on both the WHO international thresholds and the Asian cut-offs, where the risk starts lower — plus your healthy weight range in kg. Most calculators show only the first.

All free, all running entirely in your browser. Built by Maxverse Lab, a remote software studio. Every tool.