Hex to Base64 Converter

Hex and Base64 Both Encode Bytes — Just Differently

Hexadecimal and Base64 are two ways to write the same thing: a sequence of bytes as printable ASCII. They differ in density and character set, not in what they represent. Hex uses 16 characters (0–9, a–f), one nibble (4 bits) per character, so two characters per byte. Base64 uses 64 characters (A–Z, a–z, 0–9, +, /) and packs 6 bits per character, so 4 characters per 3 bytes. Base64 is denser — about 67% the length of hex — but harder to read at a glance.

When You'll Need to Convert

Cryptography is the main place these encodings collide:

• HMAC signatures — OpenSSL prints them as hex, GitHub webhook headers use hex (X-Hub-Signature-256: sha256=<hex>), Stripe uses Base64url (v1=<b64u>), Slack uses hex.
• Hash digests — SHA-1, SHA-256, SHA-512 are typically displayed as hex, but JWT thumbprints and many key fingerprints use Base64url.
• JWT debugging — header and payload are Base64url-encoded JSON; signatures are Base64url-encoded bytes. Comparing a JWT signature to a hash digest requires hex ↔ Base64url conversion.
• Key material — you generate a key with openssl rand -hex 32 and need to paste it into a config that expects Base64.
• Webhook secret rotation — copying a secret between providers that use different format conventions.

Base64 vs Base64url

Standard Base64 (RFC 4648 §4) uses these 64 characters: A-Z a-z 0-9 + / with = padding. The +, /, and = are problematic in URLs (they need percent-encoding), in filenames (slash is a path separator), and in HTTP headers. Base64url (RFC 4648 §5) solves this by substituting - for + and _ for /, and by convention dropping the = padding. The encoded bytes are identical; you can switch between the two with three character substitutions.

Format Cleanup the Tool Does for You

Real-world hex strings come in many flavors. The parser tolerates:

• Prefixes — 0x, 0X, whsec_, sha256= are stripped automatically.
• Whitespace, colons, dashes — formats like ab:cd:ef or AB CD EF work without extra cleanup.
• Mixed case — both DEADBEEF and deadbeef parse identically.

Base64 input similarly tolerates whitespace and missing padding. The parser auto-detects whether you've pasted standard Base64 (+/) or Base64url (-_) and decodes either correctly.

Doing It in Code

// Node.js
Buffer.from(hex, 'hex').toString('base64')
Buffer.from(hex, 'hex').toString('base64url')   // Node 16+
Buffer.from(b64, 'base64').toString('hex')

// Python
import base64
base64.b64encode(bytes.fromhex(hex)).decode()
base64.urlsafe_b64encode(bytes.fromhex(hex)).rstrip(b'=').decode()
bytes.fromhex(hex)               // hex string → bytes
bytes.fromhex(hex).hex()         // bytes → lowercase hex string

// Browser (no Buffer)
function hexToBytes(h) {
  const a = new Uint8Array(h.length / 2);
  for (let i = 0; i < a.length; i++) a[i] = parseInt(h.substr(i*2, 2), 16);
  return a;
}
function bytesToB64(a) {
  return btoa(String.fromCharCode(...a));
}

For working with HMAC signatures specifically, see the Webhook Secret Generator. To compute a hash from input, the Hash Generator outputs in both hex and Base64.