Base64 carries bytes through text channels
Base64 turns arbitrary bytes into ASCII letters, digits, plus two symbols. Email gateways, JSON fields, query strings, plus older APIs expect text. Raw JavaScript with quotes, backslashes, or emoji breaks those transports unless you escape every special character.
Encoding is reversible. Anyone with atob() or the Base64 to JavaScript page reads the source back in seconds. Do not treat the output as secrecy.
Teams sometimes paste encoded scripts hoping reviewers skip them. Security reviewers decode Base64 on sight. For name mangling or control-flow hiding, open the JavaScript Obfuscator instead. This page only changes representation, not behavior or readability after decode.
Where a Base64 JS string shows up in real work
- JSON config blobs where a
scriptorpayloadfield must stay a single unbroken string. - Unit tests comparing a known snippet against an API response without re-escaping quotes in the test file.
- Data URLs for one-file demos:
data:text/javascript;base64,…loads without a separate network request, though CSP often blocks inline execution anyway. - Webhook debugging when a partner sends Base64-wrapped script fragments you need to eyeball before decode.
Production sites rarely ship executable logic as Base64. Browsers cache external .js files; inline encoded blobs bypass cache, inflate HTML weight, plus fight Content-Security-Policy rules on script-src.
Pick the right encoder for the job
| Goal | This page | Better fit |
|---|---|---|
| Hide logic from end users | No | Obfuscator (still not encryption) |
| UTF-8 JavaScript into JSON | Yes | None needed |
| Plain text, no JS syntax | Overkill | Text to Base64 |
| Decode a partner payload | Wrong direction | Base64 to JavaScript |
| Check syntax before encoding | No validation | JavaScript Validator |
What happens when you paste
The browser treats your editor text as a UTF-8 string, not as executable code. No parsing step runs. Syntax errors in the source still encode faithfully because the tool works on characters, not an AST.
- 1. UTF-8 bytes
encodeURIComponentturns Unicode code points into percent-encoded bytes. Emoji in a template literal survive this step.- 2. Binary string
unescapemaps those bytes into a Latin-1 stringbtoaaccepts. This pattern is the standard browser workaround for non-ASCII source.- 3. Base64 alphabet
btoaemits the familiar A–Z / a–z / 0–9 / + / / stream with=padding when needed.
Load the sample button to watch a short ES6 file grow into a single line. Copy the output, paste into the decode page, you should recover the original text byte for byte.
Size numbers below the output panel
Base64 expands binary data by roughly one third. A 300-byte script becomes about 400 characters in the encoded form. The overhead row compares Blob sizes of source versus output so you see the penalty before pasting into a ticket or config file.
Very large bundles (hundreds of kilobytes) still encode, but the textarea slows down on weak hardware. Minified vendor files belong on disk or in a build step, not inside a browser textarea.
Unicode, minified files, plus odd line endings
Windows CRLF endings encode as two bytes per newline. Unix LF uses one. The round trip preserves whichever style you pasted. Minified one-line webpack output produces one very long Base64 line with no internal breaks, which is normal.
Source maps, license comments, plus non-Latin identifiers all encode. Nothing strips comments or renames symbols. Run the JavaScript Beautifier first if you want readable source before encoding for documentation screenshots.
Decode pattern you will see in the wild
const source = atob('Zm9vYmFy');const fn = new Function(source);fn();Patterns like this appear in legacy snippets. Modern codebases prefer module imports or fetched files. If you receive an encoded block from an unknown sender, decode in a sandbox, read the source on the JavaScript Viewer, then decide whether to run anything.
Nothing uploads
Encoding uses built-in browser APIs only. Your paste never leaves the tab. Clear both panels when you finish on a shared machine. Download writes a local .txt file; delete afterward if the script is sensitive.
