Privacy — web app vs API
The base64app website never uploads what you paste into the decoder or encoder — processing stays in your browser. The HTTP API is different by design: when you POST to /api/analyze, /api/encode, and similar routes, the JSON body (your base64 string or text) is sent to api.base64app.com, processed on our server, and returned in the response. We do not store payloads in a database or use them for analytics. Each request is handled statelessly. Do not send secrets through the API unless you accept HTTPS transit and server-side processing. For maximum privacy, use the free web tool or run the same logic locally.
Overview
JSON HTTP API at https://api.base64app.com for decoding, repairing, detecting file types, and encoding base64. POST request bodies are processed on the server and are not stored in a database. Human-readable docs at base64app.com/api/. OpenAPI spec at https://api.base64app.com/api/openapi.json. For private in-browser decoding, use the web app.
Endpoints
- GET /api/health — health check
- GET /api/openapi.json — OpenAPI 3.1 specification
- POST /api/decode — decode base64 (alias of analyze)
- POST /api/analyze — decode, repair, and detect file type
- POST /api/detect — detect file type from base64
- POST /api/to-file — decode with file download metadata
- POST /api/repair — repair base64 without full analysis
- POST /api/encode — encode text to base64
Explore
- Swagger UI — interactive API reference
- openapi.json — machine-readable spec
