Base64 API

Request parameters

Response fields

A successful response is {"ok":true,"data":{…}}. These fields are inside data.

result · string

The converted text. Empty input can produce an empty result.

Integrating Base64 into JSON workflows

Use this endpoint when a script or webhook needs a text value represented in Base64. It returns the encoded string inside data.result, so the caller can place it in another JSON document without extracting text from a web page. Use urlSafe for tokens that must avoid + and /, and padding:false only when the receiving system accepts unpadded input.

Strict decoding and UTF-8

Decoding accepts correctly padded input or a valid unpadded form. Whitespace, mixed alphabets, incorrect padding and nonzero trailing pad bits are rejected. Decoded bytes must be valid UTF-8; use a binary-safe library for images, archives or other files. Base64 represents data and does not encrypt it.

Round-trip behavior

Encoding then decoding preserves the UTF-8 text, including emoji and non-Latin scripts. A URL-safe decode must explicitly set urlSafe:true. The endpoint does not detect or unwrap data: URLs, and it does not fetch remote files.

cURL, JavaScript and Python examples

curl --fail-with-body --request POST 'https://www.base64.sh/api/v1/base64/' \
  --user-agent 'Base64.sh API example/1.0' --header 'Content-Type: application/json' \
  --data-raw '{"text":"Hello 世界"}'

const response = await fetch("https://www.base64.sh/api/v1/base64/", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({
  "text": "Hello 世界"
})
});
if (!response.ok) throw new Error(await response.text());
console.log(await response.json());

import json
from urllib.request import Request, urlopen

payload = json.loads("{\n  \"text\": \"Hello 世界\"\n}")
request = Request(
    "https://www.base64.sh/api/v1/base64/",
    data=json.dumps(payload, ensure_ascii=False).encode("utf-8"),
    headers={"Content-Type": "application/json", "User-Agent": "Base64.sh API example/1.0"},
    method="POST",
)
with urlopen(request, timeout=15) as response:
    print(json.load(response))

{
  "ok": true,
  "data": {
    "result": "SGVsbG8g5LiW55WM"
  }
}

curl --fail-with-body --request POST 'https://www.base64.sh/api/v1/base64/' \
  --user-agent 'Base64.sh API example/1.0' --header 'Content-Type: application/json' \
  --data-raw '{"text":"SGVsbG8=","operation":"decode"}'

const response = await fetch("https://www.base64.sh/api/v1/base64/", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({
  "text": "SGVsbG8=",
  "operation": "decode"
})
});
if (!response.ok) throw new Error(await response.text());
console.log(await response.json());

import json
from urllib.request import Request, urlopen

payload = json.loads("{\n  \"text\": \"SGVsbG8=\",\n  \"operation\": \"decode\"\n}")
request = Request(
    "https://www.base64.sh/api/v1/base64/",
    data=json.dumps(payload, ensure_ascii=False).encode("utf-8"),
    headers={"Content-Type": "application/json", "User-Agent": "Base64.sh API example/1.0"},
    method="POST",
)
with urlopen(request, timeout=15) as response:
    print(json.load(response))

{
  "ok": true,
  "data": {
    "result": "Hello"
  }
}

Invalid request example

{
  "text": "%%%",
  "operation": "decode"
}

HTTP 400

{
  "ok": false,
  "error": {
    "code": "INVALID_INPUT",
    "message": "Invalid Base64 alphabet or padding."
  }
}

Limits and error handling

Requests require Content-Type: application/json and a UTF-8 JSON object. The body limit is 32 KiB (32,768 bytes), text fields allow up to 16,384 Unicode code points unless a smaller limit is listed, and responses are limited to 256 KiB. Unknown parameters and unpaired Unicode surrogates in parameter strings are rejected. Send inputs in the request body, not query parameters.

Anonymous access is limited to approximately 60 POST requests per minute per IP address, shared across endpoints in each Cloudflare location. Shared networks share the allowance. Counters are eventually consistent, not a guaranteed global quota. On HTTP 429, wait for the Retry-After interval before retrying; avoid immediate retry loops.

Programmatic clients should send an identifying User-Agent, as shown in the cURL and Python examples. Browser fetch supplies its own header. Cloudflare may reject a generic or missing agent before the API runs; an edge-generated 403 can be plain text or HTML rather than the JSON envelope. See Cloudflare error 1010.

400 · Invalid input

Malformed JSON, missing fields, unsupported options or invalid encoded text. Correct the input before retrying.

403 · Edge request blocked

Check the User-Agent and the Cloudflare error response before retrying.

404 · Unknown endpoint

Use a documented /api/v1/{tool}/ endpoint.

405 · Method not allowed

Use POST. OPTIONS is supported for browser CORS requests.

413 · Size limit exceeded

Reduce the request size or the generated output.

415 · Unsupported media type

Set Content-Type: application/json.

429 · Rate limited

Wait at least the Retry-After number of seconds.

500 / 503 · Service unavailable

Retry later with bounded backoff. Availability is not guaranteed.

API data processing

API inputs are sent over HTTPS and processed in memory by a Cloudflare Worker. The application does not persist submitted text or deliberately log request bodies, and API responses use Cache-Control: no-store. Cloudflare may process network metadata under its own policies. For local processing, use the corresponding browser tool. See the privacy policy.