Encoding is not encryption
Base64 maps every three bytes to four ASCII characters. Anyone who sees the string can decode it in one click. Do not treat Base64 as a way to hide passwords, API keys, or personal data. If you need confidentiality, use TLS in transit and a real cipher at rest. ToolPin Base64 Encode only transforms representation. It runs in your browser, uploads nothing, is free, and needs no account.
HTTP Basic authentication uses Base64(username:password). That is a transport convention, not protection — it must only be used over HTTPS, and it is still not a substitute for OAuth or hashed passwords on a server.
UTF-8 and binary
This page encodes text. The browser treats your paste as Unicode and typically encodes the UTF-8 bytes. That is what you want for ordinary copy. If you need to encode a file (a PNG, a PDF), a dedicated file-to-Base64 tool is more appropriate; pasting binary into a text box will corrupt it.
Output uses the standard alphabet + and / with = padding. URL-safe Base64 replaces those with - and _ and may drop padding. If a JWT or a URL rejects your string, you may need the URL-safe variant — this encoder is the classic MIME-style alphabet unless the UI says otherwise.
Line breaks every 76 characters appear in some MIME encoders. Modern APIs usually want a single line. If a decoder complains about whitespace, strip newlines.
Size and performance
Base64 expands data by about 33%. A 300-character string becomes about 400 characters. That is expected. Do not Base64 large files in a text box; the tab will grow quickly.
Round-trip: encode here, decode on Base64 Decode. If the decoded text has replacement characters, the original was not UTF-8 text or the string was truncated (missing padding).
Privacy
Because encoding is local, you can Base64 a draft email or a token without sending it to a paste site. The output is still readable by anyone with a decoder, including anyone looking at your screen.
Do not confuse this with hashing (MD5, SHA-256 on ToolPin). Hashes are one-way fingerprints. Base64 is two-way. Do not confuse it with URL encode either — percent-encoding is a different mapping for URLs.
When Base64 is the wrong tool
If you need a checksum, use SHA-256 (or MD5 only for a legacy checksum). If you need to put a name in a query string, use URL Encode. If you need to hide a secret, use encryption and TLS, not an alphabet change. Base64 shows up in PEM certificates, SMTP attachments, and JSON web tokens as a wrapper — the wrapper is not the security.
ToolPin does not store what you encode. Copy the string into the system that asked for Base64 and delete it from shared chats if it wraps a token.