Base64 Decode Online

Decode Base64 encoded text

Base64 Input

Decoded Text

Runs locally Β· Safe to paste secrets
Decoded output...

What Is Base64 Decoding?

Base64 decoding is the reverse process of Base64 encoding: it converts a Base64-encoded ASCII string back into the original binary data or text. Every 4 Base64 characters decode to 3 bytes of original data. The decoder looks up each character in the Base64 alphabet, reconstructs the original 6-bit groups, and reassembles them into 8-bit bytes.

Base64-encoded data is recognisable by its use of uppercase and lowercase letters, digits, and either +/ (standard) or -_ (URL-safe), often ending with one or two = padding characters. It appears frequently in JWT tokens, email attachments, data URIs, API responses, and configuration files β€” anywhere binary or structured data must be embedded in a text-only context.

Why Use This Tool?

This decoder handles both standard and URL-safe Base64, automatically fixes missing padding, and decodes entirely in your browser with no data sent to servers.

⚑
Auto-fixes Padding
Many sources produce Base64 without trailing = characters. This tool automatically calculates and adds missing padding before decoding, preventing InvalidCharacterError exceptions.
πŸ›‘οΈ
Both Variants Supported
Automatically detects and handles both standard Base64 (+/) and URL-safe Base64 (-_), so you can paste tokens from any source without manual conversion.
πŸ”’
Fully Client-side
Decoding happens locally in your browser using the native atob API. Your data β€” which may contain secrets or sensitive content β€” never leaves your device.
🌐
Unicode Output
Correctly decodes UTF-8 encoded text back to full Unicode, including multi-byte characters, emoji, and CJK scripts.

How to Use This Base64 Decoder Online

No account, no upload, no configuration β€” paste a Base64 string and the decoded output appears instantly.

  1. 1
    Paste Your Base64 String
    Click the input field and paste any Base64-encoded string β€” standard (+/) or URL-safe (-_) format. The decoder accepts strings with or without padding (= characters) and handles both variants automatically.
  2. 2
    Auto-Detection and Repair
    The decoder automatically detects whether the input is standard or URL-safe Base64 and restores missing padding before decoding. No manual adjustment needed.
  3. 3
    Inspect the Output
    The decoded result appears on the right. If the input was valid UTF-8 text, you will see the original string. If it was binary data, the output will show the raw bytes as text β€” some characters may appear as replacement characters.
  4. 4
    Copy or Use the Result
    Click Copy to send the decoded text to your clipboard. Use it to inspect JWT payloads, recover encoded configuration values, or verify what a Base64 string actually contains.

How Decoding Works

Each Base64 character maps to a 6-bit value (0–63). Four consecutive characters provide 24 bits, which decode to 3 bytes of original data. The example below shows how "TWFu" decodes back to "Man":

Example "Man" β†’ TWFu β†’ "Man"
CharIndex6 bits
T19010011
W22010110
F5000101
u46101110

The four 6-bit groups (010011 010110 000101 101110) are concatenated to 24 bits, then split into three 8-bit bytes: 01001101 (M=77), 01100001 (a=97), 01101110 (n=110).

Understanding Padding

Base64 encoding groups input bytes in sets of 3. When the input length is not divisible by 3, padding (=) characters are added to complete the final group. When decoding, these = characters are stripped and the decoder knows to discard the extra zero-bits that were added during encoding.

OriginalEncodedPadding rule
AQQ==1 byte β†’ 2 padding chars
ABQUI=2 bytes β†’ 1 padding char
ABCQUJD3 bytes β†’ no padding needed

Common Use Cases

Inspect JWT Payloads
JWT tokens consist of three URL-safe Base64-encoded segments. Decoding the second segment (payload) reveals the claims: user ID, roles, expiry time, and other metadata β€” without needing a signature key.
Read API Responses
REST APIs frequently return binary data (file contents, thumbnails, cryptographic material) Base64-encoded in JSON responses. Decode the field to read the original data.
Decode Email Content
MIME email bodies and attachments are Base64-encoded. Decoding them reveals the original text content or allows you to reconstruct binary attachments.
Extract Kubernetes Secrets
Kubernetes stores secret values as Base64 in YAML manifests. Decoding them reveals the actual passwords, tokens, and keys stored in the cluster β€” useful for debugging and auditing.
Debug Configuration
Environment variables and CI/CD pipeline secrets are often Base64-encoded for safe storage in YAML or JSON configuration files. Decode them to verify the actual values during debugging.
Decode Data URIs
Data URIs embed Base64-encoded assets directly in HTML/CSS. Decode the Base64 portion to extract the original image, font, or other embedded resource.

Common Pitfalls

These are the most frequent causes of Base64 decoding errors in practice:

βœ•
Missing Padding
Base64 strings must have a length that is a multiple of 4. Many APIs and JWT libraries strip trailing = for compactness. Add back the padding: missing = count is (4 - length % 4) % 4.
βœ•
URL-safe Characters Not Converted
URL-safe Base64 uses - and _ instead of + and /. If you pass URL-safe Base64 directly to atob() or base64.b64decode(), it will fail. Always replace - β†’ + and _ β†’ / before decoding with standard libraries.
βœ•
Whitespace and Line Breaks
PEM certificates, MIME data, and copy-pasted Base64 often contain line breaks every 76 characters. Strip all whitespace before decoding to avoid InvalidCharacterError.
βœ•
Binary vs Text Output
Base64 can encode any binary data, not just text. If the original data was a binary file (image, PDF), decoding it as UTF-8 text will produce garbage. Use the appropriate binary output method for non-text payloads.

Code Examples

How to Base64-decode a string in popular languages and environments:

JavaScript (browser)
// Standard Base64
const decoded = decodeURIComponent(escape(atob(encoded)))

// URL-safe Base64 (restore padding first)
function decodeUrlSafe(str) {
  const padded = str.replace(/-/g, '+').replace(/_/g, '/')
  const pad = padded.length % 4
  return decodeURIComponent(escape(atob(padded + '='.repeat(pad ? 4 - pad : 0))))
}
Node.js
// Standard
const decoded = Buffer.from(encoded, 'base64').toString('utf8')

// URL-safe
const decoded = Buffer.from(encoded, 'base64url').toString('utf8')
Python
import base64

# Standard
decoded = base64.b64decode(encoded).decode('utf-8')

# URL-safe (add padding if missing)
padding = '=' * (-len(encoded) % 4)
decoded = base64.urlsafe_b64decode(encoded + padding).decode('utf-8')
CLI (bash)
# Standard
echo "SGVsbG8sIFdvcmxkIQ==" | base64 -d

# URL-safe (restore + and / first)
echo "SGVsbG8sIFdvcmxkIQ" | tr '-_' '+/' | base64 -d

Base64 Decoder Online vs. Other Tools

Several Base64 decoders exist online. The key differences for daily developer use are privacy, auto-repair, and Unicode handling.

Fully Private β€” No Server
This decoder runs entirely in your browser. Your Base64 strings β€” which may contain API keys, tokens, or secrets β€” are never transmitted to any server.
Auto-Fixes Missing Padding
Many decoders fail when padding = characters are missing (common in JWT and URL-safe strings). This tool automatically restores correct padding before decoding.
Unicode and Binary Aware
Correctly decodes UTF-8 encoded strings including emoji, CJK, and all non-ASCII characters. Handles binary output gracefully without throwing errors.

Frequently Asked Questions

Why does decoding give me garbage characters?
The most common cause is decoding binary data (images, compressed files) as UTF-8 text β€” binary bytes often don't form valid Unicode sequences. Another cause is decoding URL-safe Base64 (-_) with a standard decoder that expects +/. Check which variant your source uses.
What is InvalidCharacterError?
This browser error from atob() occurs when the input contains characters outside the Base64 alphabet, such as URL-safe characters (- or _), whitespace, line breaks, or non-ASCII characters. Strip whitespace and convert URL-safe characters before calling atob().
How do I know if my Base64 is URL-safe or standard?
Look for - or _ characters: if present, it is URL-safe Base64. Standard Base64 uses + and /. URL-safe Base64 also typically omits padding = characters. JWT tokens always use URL-safe Base64.
Can Base64 decoding fail silently?
Yes. Some decoders silently ignore invalid characters rather than throwing an error, producing incorrect output. Always validate that your decoded data matches the expected format (JSON, image header, etc.) rather than assuming the decoder succeeded.
Is there a size limit for Base64 decoding?
This browser-based tool can handle Base64 strings up to a few megabytes before the UI becomes slow. For very large files (multi-MB Base64 strings), use a CLI tool or server-side decoder which can process arbitrarily large inputs efficiently.
Why does Base64 end with one or two = signs?
= is the padding character. Base64 encodes 3 bytes into 4 characters. If the original data length is not a multiple of 3, one or two = characters are appended so the total output length is a multiple of 4. One = means 2 input bytes in the last group; two == means 1 input byte.
How do I decode a Base64 image?
If you have a data URI like data:image/png;base64,iVBORw..., strip the prefix and paste only the Base64 part. The decoded bytes represent the raw binary image. This tool decodes to text β€” to view the image, use the full data URI directly in an img src attribute in HTML.
Why does my decoded output contain garbled characters?
Garbled output usually means the original data was binary (an image, PDF, or other non-text file) rather than text. Base64 can encode any bytes β€” not just text. If the source was binary, the decoded result is not valid UTF-8 and will appear as random characters.