Base64 rewrites arbitrary data using only letters, digits and a couple of symbols, so it can travel through channels that expect text — a JSON field, a data URI in a stylesheet, an email attachment header, a Kubernetes secret. This tool converts in both directions, for typed text and for whole files, and can produce the URL-safe variant that swaps the two characters a query string would otherwise mangle. It runs locally, which is the point: the strings people decode are usually tokens, keys and secrets, and pasting those into a site that posts them to a server hands them over.
No. Encoding and decoding use your browser's own functions inside the page. Nothing is logged or transmitted, which is why it is safe to decode a token here.
No, and this matters. It is an encoding, not a cipher — anyone can reverse it instantly with no key. Never treat a base64 string as a way to hide a password or a secret; it only changes the alphabet, not the readability.
Standard base64 uses + and /, which have their own meaning inside a URL, and = padding, which is often stripped. The URL-safe variant writes those as - and _ and omits the padding, so the value survives being placed in a query string, a path or a filename. This tool accepts both when decoding.
Base64 represents three bytes with four characters, so the output is about 33 percent larger, plus any line breaks. That overhead is the price of being able to send binary data through a text-only channel.
Because the bytes are not valid UTF-8 — you decoded something binary, such as an image or a PDF. Switch to file mode, which writes those bytes to a file instead of trying to display them.