Encode text to base64 or decode it back, with UTF-8 handled correctly and a URL-safe variant for tokens and query strings.
The result appears herebtoa only accepts characters in the Latin-1 range. This tool encodes the text to UTF-8 bytes first and base64s those bytes, so emoji, accented characters and any other Unicode round trip correctly.
Standard base64 uses + and /, which have meaning inside URLs. The URL-safe alphabet replaces them with - and _ and drops the = padding. It is what JWTs and most token formats use.
You can decode each segment by hand, since a JWT is three URL-safe base64 strings separated by dots. A dedicated JWT decoder that splits and pretty prints the payload is on the way.
No, and treating it as such is how secrets end up in public. Base64 is a way to carry bytes through a text channel; anyone can decode it with no key. It hides nothing, it only survives transport.
Because three bytes become four characters, so anything encoded grows by about a third, plus padding. That is the cost of putting a data URI inline, and the reason a base64 image in your CSS is bigger than the file it came from.