2026-10-21 · 7 min read
- base64
- encoding
- tooling
The Base64 page is a UTF-8 encode and decode box. Encode runs TextEncoder and standard btoa. Decode runs atob and TextDecoder. The alphabet is A–Z, a–z, 0–9, +, /, and =. A box that trims to empty returns an empty string before either function runs.
That empty check is the only trim. Spaces that sit beside real text are encoded. Spaces that sit inside a token are removed by atob during decode.
Encode the string, including its spaces and newlines
flashman becomes Zmxhc2htYW4=. é becomes w6k=. 🙂 becomes 8J+Zgg==. A line feed between a and b becomes YQpi. A CRLF between a and b becomes YQ0K. The three characters space, a, space become IGEg. Nothing in encode converts + and / to - and _, and nothing inserts line breaks.
Round-trip the encode output through decode when the text is the point. The emoji and the accented letter come back. A hash of the encoded form will not match a hash of the original text.
- Decide whether leading spaces are data.
- Pick LF or CRLF and encode that choice.
- Keep padding if a later decoder is strict.
- Keep + and / for this page.
Expect a forgiving standard decode
Padding is optional here. Zmxhc2htYW4 and Zmxhc2htYW4= are both flashman. YQ and YQ== are both a. ASCII spaces and newlines inside the token are skipped. Zm xh is fla. A token split across two lines still decodes. A trailing space after YQ== still decodes.
The URL-safe minus sign does not get that forgiveness. ab-c throws Error: Invalid character. So do *, a row of exclamation marks, and a pasted é in decode mode. + and / are valid characters. If the bytes they produce are not UTF-8, TextDecoder inserts the replacement character and the page still shows that string. abc= is one of those results. It is not an Error: line.
Translate a JWT segment before you paste it here
JWT segments are base64url. They omit padding and they use - and _. This page will stop on those characters. Replace - with + and _ with / , then add padding if you want a strict token, and decode. The JWT page already restores the alphabet when it shows header and payload.
A whitespace-only box is a different case from a token that contains whitespace. The first returns an empty panel. The second decodes. Look at the input before you call the output blank.
Copy the error when the alphabet is wrong
Failures are written into the output as Error: plus the decoder message, which for a bad character is Invalid character. Copy copies that line because it is the output. Clear it before you paste the next sample into a ticket.
Use the Base64 tool for standard text, the JWT tool for tokens, the hash tool for a digest of the original UTF-8, and diff when two encodings of the same sentence disagree. The disagreement is usually a newline, a padding character, or a URL-safe alphabet.