Base64 Encoder & Decoder
Encode text to Base64 or decode Base64 strings instantly.
100% client-side. Your data never leaves your browser.
Error
In Laravel
The first Base64 string in a Laravel app is in .env: APP_KEY=base64:.... php artisan key:generate creates 32 random bytes for the default cipher, AES-256-CBC. Raw bytes are not safe in a text file, so Laravel stores them Base64-encoded, and the base64: prefix tells it to decode the value before use.
In your own code, the string helpers wrap PHP's base64_encode() and base64_decode():
use Illuminate\Support\Str;
Str::toBase64('Laravel'); // 'TGFyYXZlbA=='
Str::fromBase64('TGFyYXZlbA=='); // 'Laravel'Values from Crypt::encryptString() are Base64 too. The first question below shows what is inside one.
Laravel 13.x docs: Encryption, Str::toBase64()
Client-Side
All processing happens in your browser. Your data never touches our servers.
No Signup
Use unlimited times without creating an account.
Instant Results
Encode and decode Base64 instantly with keyboard shortcuts support.
Related Tools
Need something custom built?
I build custom Laravel tools, web apps, and SaaS platforms. If you need something beyond off-the-shelf, let's talk.
ContactFrequently Asked Questions
Can I decode a Laravel encrypted value here?
You can decode it, but you cannot read the secret. A value from Crypt::encryptString() or an encrypted cast is Base64-encoded JSON with four keys: iv, value, mac and tag. value is still encrypted, and only the app's APP_KEY can decrypt it. Decoding helps when a value does not decrypt: if the JSON is cut off, the database column was too short. Laravel's documentation recommends a TEXT column for encrypted attributes.
Why is the Base64 text longer, and what are the = signs?
Base64 writes every 3 bytes as 4 characters, so the output is about a third larger than the input. The output length is always a multiple of 4. When the input does not divide into groups of 3 bytes, = or == fills the last group.
What is URL-safe Base64?
Standard Base64 uses + and /, which have a meaning in URLs. The URL-safe variant uses - and _ instead, and usually drops the = padding. JWTs use it. PHP has no function for it, so convert with rtrim(strtr(base64_encode($data), '+/', '-_'), '=').