ForHosting KIT · Developer Utilities

Encode and decode Base64

Base64 looks trivial until you're juggling standard versus URL-safe alphabets, padding characters that break query strings, or a batch of files that need encoding server-side without loading a library. This endpoint handles both directions, both alphabets, and both single values and batches, so the edge case you hit at 2 a.m. is already covered.

● StableFree · in your browser

Run — free How it works & API

Use it from WebAPIEmailApp soonTelegram soon

A 1987 trick still doing heavy lifting

Base64 was formalized to move binary data safely through channels built for text, originally email attachments under MIME, and the same problem shows up constantly today: embedding images in JSON, passing binary tokens through URLs, or storing arbitrary bytes in text-only database columns. The core idea has not changed in decades, but the details, which alphabet, whether to pad, whether characters need escaping, still trip people up in production.

Standard vs. URL-safe, and why it matters

The standard Base64 alphabet uses + and / as two of its 64 symbols, both of which have special meaning inside a URL, so a token encoded the standard way can silently break a query parameter or a route segment. The URL-safe variant swaps those for - and _ and typically omits padding, which is exactly what you want for tokens, slugs, or identifiers that travel in a URL. This endpoint lets you pick the alphabet explicitly instead of guessing which one the receiving system expects.

How a request works

Send a POST /dev/base64 request specifying the operation (encode or decode), the alphabet, and either a single payload or an array of them; the call returns a task_id right away while the actual conversion runs asynchronously. Results arrive via a signed webhook, recommended for pipelines, or through a signed link that stays live for 24 hours before the data is deleted for good. Nothing you send through this endpoint is retained past that window or used to train anything.

Where it earns its keep

Backend services use it to encode binary attachments before embedding them in JSON payloads, front-end teams use it to decode tokens received from third-party auth providers, and data pipelines use bulk mode to convert thousands of records in one call instead of spinning up a library in every microservice. Because the endpoint requires prepaid balance rather than offering a free tier, it stays available and abuse-free, and a failed conversion, after three automatic retries, is simply never billed.

What you can do with it

Embedding images in JSON APIs

Encode a binary image or PDF into Base64 before including it inline in an API response, without maintaining an encoding library in every service.

Decoding third-party auth tokens

Decode URL-safe Base64 tokens received from an identity provider to inspect their contents during debugging or integration work.

Bulk-converting legacy data exports

Send an array of thousands of binary blobs in one call to encode them for storage in a text-only database column.

Sanitizing tokens for query strings

Re-encode a standard Base64 value into the URL-safe alphabet so it survives being passed as a query parameter without escaping issues.

FAQ

Is this Base64 API free to use?

The tool above runs free in your browser. The API is paid — each call draws from your prepaid ForHosting KIT balance: top up from $10.00 (it never expires), pay each request's published price, and a call with no balance returns HTTP 402. No subscription, no tokens, and a failed task is never charged.

What's the difference between standard and URL-safe Base64?

Standard Base64 uses + and / and can include padding, while URL-safe Base64 replaces those with - and _ so the output can travel inside a URL without escaping.

Can I decode as well as encode?

Yes, POST /dev/base64 accepts an operation parameter for both encode and decode in either alphabet.

Does it support bulk requests?

Yes, you can send an array of payloads in a single call, which is more efficient than issuing one request per value for large batches.

How do I get the encoded or decoded result?

The endpoint is asynchronous: it returns a task_id immediately and delivers the result through a signed webhook or a signed link valid for 24 hours.

Is padding included in the output?

You choose the alphabet, and standard Base64 includes padding characters while the URL-safe variant is commonly used without them.

What happens if a conversion fails?

The system retries automatically up to three times, and if it still fails you receive a clear error with no charge for that request.

Is my data kept or used for training?

No, payloads and results are deleted once the retention window closes and are never used to train any model.

For developers — API access

Everything on this page is available programmatically. This section is for teams who want to wire it into their own systems; everyone else can just use the tool above.

API endpoint

POSThttps://api.kit.forhosting.com/dev/base64

Prefer to automate it? One authenticated POST creates the task; the result comes back by webhook or a signed link. The same capability also runs here on the web, and soon from our app, email and Telegram.

Call it from your stack

curl -X POST https://api.kit.forhosting.com/dev/base64 \
  -H "Authorization: Bearer $KIT_KEY" \
  -H "Content-Type: application/json" \
  -d &#39;{"items":["valor-1","valor-2"]}'

const res = await fetch("https://api.kit.forhosting.com/dev/base64", {
  method: "POST",
  headers: {
    "Authorization": `Bearer ${process.env.KIT_KEY}`,
    "Content-Type": "application/json"
  },
  body: JSON.stringify({
    "items": [
      "valor-1",
      "valor-2"
    ]
  })
});
const { task_id } = await res.json();

import os, requests

res = requests.post(
    "https://api.kit.forhosting.com/dev/base64",
    headers={"Authorization": f"Bearer {os.environ[&#39;KIT_KEY']}"},
    json={
    "items": [
        "valor-1",
        "valor-2"
    ]
},
)
task_id = res.json()["task_id"]

<?php
$res = file_get_contents("https://api.kit.forhosting.com/dev/base64", false, stream_context_create([
  "http" => [
    "method"  => "POST",
    "header"  => "Authorization: Bearer " . getenv("KIT_KEY") . "\r\nContent-Type: application/json",
    "content" => &#39;{"items":["valor-1","valor-2"]}',
  ],
]));
$task = json_decode($res, true);

body := bytes.NewBufferString(`{"items":["valor-1","valor-2"]}`)
req, _ := http.NewRequest("POST", "https://api.kit.forhosting.com/dev/base64", body)
req.Header.Set("Authorization", "Bearer "+os.Getenv("KIT_KEY"))
req.Header.Set("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)

Example request

{
  "items": [
    "valor-1",
    "valor-2"
  ]
}

Example response

{
  "task_id": "tsk_a1b2c3d4e5f6a1b2c3d4e5f6",
  "type": "dev.base64",
  "status": "queued",
  "_links": {
    "result": "/tasks/tsk_…/result"
  }
}

The API is asynchronous: the call returns a task_id immediately and the result arrives by webhook. Polling is capped at 1 req/s per task.

Pricing

Per request$0.002

Published price — no tokens, no invented credits. A failed task is never charged.

Errors

HTTP	Code	Meaning
`401`	`unauthorized`	Missing or invalid API key.
`402`	`insufficient_balance`	Your balance doesn't cover the task price.
`404`	`unknown_type`	That task type doesn't exist.
`429`	`rate_limited`	Too many requests. Use the webhook instead of polling.

Read the full KIT documentation →

Run — free