Base64 is how binary pretends to be text: PEM keys, data URLs, JSON fields that cannot hold raw bytes. Base64Shift encodes and decodes text or files in the browser. It is not encryption. Anyone who can read the output can reverse it. Use it to paste a small file into a config, to unwrap a data URL, to debug a JWT-looking blob that is actually just base64. Do not use it to 'hide' a password in a ticket, and do not paste a private key into a web encoder that uploads. This one does not upload. The checksums guide is explicit about the cargo cult.
Text in, base64 out, or the reverse. Files become a string you can drop into JSON. Line wrapping (PEM 64-char lines) vs a single line matters for some parsers. URL-safe base64 swaps +/ and padding; JWT uses that dialect. If decode fails, you probably have the wrong dialect or extra whitespace. Trim, try URL-safe, try standard.
When not to use it: large videos as data URLs (you will crash the tab and the page). Also skip it as a substitute for HTTPS or for ZipShift. Encoding a ZIP as base64 in email is how you create a 33 percent larger puzzle. For actual secrets, encrypt or use a manager. Base64 of a secret is still the secret, just uglier.
Privacy is local. PEM paste into a random encoder is a classic leak. Decode a certificate, fine. Decode a private key, then treat the tab as dirty. The output string in a log is still a leak. HashShift is next door if you needed a fingerprint of the bytes, not an encoding.
A 1.8 KB PNG icon needs to live in a JSON theme file. Base64Shift encodes it to a data-URL-ready string, ~2.4 KB. The app renders the icon. A second paste is a JWT-shaped string; decode shows JSON because you actually wanted JwtShift, but base64 of the payload is how you peeked. A third paste is a 'hidden' password in base64; you reject that pattern and put the secret in a manager instead.
Base64Shift encodes and decodes in the browser. Bytes stay on the device. That only helps if you do not then paste a private key into a ticket. Treat decoded keys as sensitive. Close the tab after PEM work. Treat decoded keys as sensitive even though the encoding step never left the machine.
Full policy: Shift Privacy Policy. Questions: [email protected].
No. It is an encoding. The checksums-and-base64 guide exists because this confusion never dies. Anyone can decode it. Encoding is reversible by design; the checksums guide exists because this confusion never dies.
Standard base64 vs URL-safe. JWT and some query params use the latter and often drop padding. Match the consumer. JWT and some query params use - and _ and often drop padding; match that dialect or fail loudly.
You can try, and the tab may die. Attach the PDF. Base64 in JSON is for small artifacts. Small artifacts belong in JSON; a 50 MB data URL is how you crash a tab and a page together.
Usually the input was hex, utf-7, or gzip+base64. Try hex decode elsewhere, or inflate. Base64Shift will not guess a stack of encodings. Hex, utf-7, or gzip sitting under the base64 will decode to garbage; unwrap the stack in order.
Longer guide: Checksums And Base64
Related tools: HashShift · JwtShift · UrlShift
Guides · All Shift tools · About · Contact