# Base64 Encoder / Decoder

URL: https://phishdestroy.io/developer-tools/base64-encoder-decoder
Category: General dev
Where it runs: Runs locally (nothing you enter is uploaded)

Decode Base64 back to UTF-8 text, such as a payload hidden in a phishing page or email, or encode text as standard or URL-safe Base64. Base64 is an encoding anyone can reverse, not encryption.

## Example input

Hidden form action

```
PGZvcm0gYWN0aW9uPSJodHRwczovL2NvbGxlY3QuZXhhbXBsZS9sb2dpbi5waHAiIG1ldGhvZD0icG9zdCI+
```

Decode reveals <form action="https://collect.example/login.php" method="post">, the kind of credential form that phishing HTML attachments hide in Base64.

## FAQ

### Is Base64 encryption?

No. Base64 only rewrites bytes with 64 printable characters, and anyone can decode it without a key; phishing kits use it to hide URLs and HTML from filters, not to protect data.

### Why does Decode say invalid Base64?

Decode accepts only the standard alphabet, so URL-safe input with - and _ fails. The decoded bytes must also be UTF-8 text, so Base64 of an image or ZIP file shows the same error; the URL-safe button only encodes, and Multi-Layer Decoder handles Base64 nested in other encodings.

### Is my text uploaded?

No. Encoding and decoding run in your browser with btoa and atob; nothing is sent anywhere.

## Related tools

- [Multi-Layer Decoder](https://phishdestroy.io/developer-tools/multi-layer-decoder)
- [Base64 File Converter](https://phishdestroy.io/developer-tools/base64-file-converter)
- [URL Encoder / Decoder](https://phishdestroy.io/developer-tools/url-encoder-decoder)
- [HTML Attachment Analyzer](https://phishdestroy.io/developer-tools/html-attachment-analyzer)
- [JWT Decoder](https://phishdestroy.io/developer-tools/jwt-decoder)
- [Text Hash Generator](https://phishdestroy.io/developer-tools/hash-generator)

All tools: https://phishdestroy.io/developer-tools