Base64, URL and HTML encoder and decoder

Base64 carries 6 bits in each output character against 8 bits in each input byte, so every 3 bytes become 4 characters, a ratio of 4 to 3, plus up to 2 = padding characters at the end. 21 bytes become 28 characters, and 1 MB of binary becomes about 1.33 MB. MIME email (RFC 2045) also breaks the output into lines of at most 76 characters, which adds a little more.

Base64URL (RFC 4648 §5) replaces the two characters that clash with URLs and file names, + and /, with - and _, and usually drops the = padding. JSON Web Tokens (RFC 7519) use it for all three of their parts. The text <<???>> is PDw/Pz8+Pg== in standard Base64 and PDw_Pz8-Pg in the URL-safe form, 10 characters instead of 12.

No. Base64 is a reversible encoding with no key, so anyone can decode it in one step; it only makes binary data safe to carry as text. HTTP Basic authentication (RFC 7617), for example, sends user:password in Base64, which is why it is only safe over HTTPS. To protect data, encrypt it first, for example with AES-256, and then Base64-encode the ciphertext if it must travel as text.

Both appear, in different places. RFC 3986, which governs URLs, encodes a space as %20, while HTML form submissions (application/x-www-form-urlencoded) write it as +. So a+b in a form's query string means a b, but in a URL path the + is a literal plus. JavaScript's encodeURIComponent gives %20, and Python's urllib.parse.quote_plus gives +.

One to four. Code points below U+0080 (ASCII) take 1 byte, those up to U+07FF take 2 (é, ñ, Greek, Cyrillic), those up to U+FFFF take 3 (€ and most Chinese characters) and the rest take 4, including emoji such as 😀 (U+1F600). So A€😀 is 3 characters, 8 UTF-8 bytes and 4 UTF-16 code units, because 😀 needs a surrogate pair in UTF-16 (RFC 3629).

Accuracy depends on your inputs and the method's assumptions. Decimal arithmetic uses 50 significant digits, but estimates, numerical methods and source data can be less precise; the displayed rounding does not remove those limits. It is checked against 17 worked examples whose answers come from independent sources; for example, “Base64 of “foob” (two padding characters)” is checked against RFC 4648 §10 test vectors; Python 3.8 base64.b64encode(b'foob') and len() of input and output.

RFC 4648 — The Base16, Base32, and Base64 Data Encodings; RFC 3986 §2 — URI characters and percent-encoding; RFC 3629 — UTF-8, a transformation format of ISO 10646; WHATWG HTML — Named character references; The Unicode Standard, §3.9 Unicode encoding forms.