Base64 Decode Python — b64decode() Guide

import base64
import json

# Encoded database config received from a secrets manager
encoded_config = (
    "eyJob3N0IjogImRiLXByb2QubXljb21wYW55LmludGVybmFsIiwgInBvcnQiOiA1NDMyLCAid"
    "XNlciI6ICJhcHBfc3ZjIiwgInBhc3N3b3JkIjogInM0ZmVQYXNzITIwMjYifQ=="
)

# Step 1: decode Base64 bytes
raw_bytes = base64.b64decode(encoded_config)
print(raw_bytes)
# b'{"host": "db-prod.mycompany.internal", "port": 5432, "user": "app_svc", "password": "s4fePass!2026"}'

# Step 2: convert bytes → str
config_str = raw_bytes.decode("utf-8")

# Step 3: parse into a dict
config = json.loads(config_str)
print(config["host"])    # db-prod.mycompany.internal
print(config["port"])    # 5432

import base64
import binascii

# Token from an internal event bus — validate strictly (external input)
encoded_event = (
    "eyJldmVudCI6ICJvcmRlci5zaGlwcGVkIiwgIm9yZGVyX2lkIjogIk9SRC04ODQ3MiIsICJ"
    "0aW1lc3RhbXAiOiAiMjAyNi0wMy0xM1QxNDozMDowMFoiLCAicmVnaW9uIjogImV1LXdlc3QtMSJ9"
)

try:
    # validate=True raises binascii.Error on any non-Base64 character
    raw = base64.b64decode(encoded_event, validate=True)
    event = raw.decode("utf-8")
    print(event)
    # {"event": "order.shipped", "order_id": "ORD-88472", "timestamp": "2026-03-13T14:30:00Z", "region": "eu-west-1"}

except binascii.Error as exc:
    print(f"Invalid Base64: {exc}")
except UnicodeDecodeError as exc:
    print(f"Not UTF-8 text: {exc}")

import base64
import json

# JWT payload segment (the middle part between the two dots)
# JWTs use URL-safe Base64 without trailing "=" padding
jwt_payload_b64 = (
    "eyJ1c2VyX2lkIjogMjg5MywgInJvbGUiOiAiYWRtaW4iLCAiaXNzIjogImF1dGgubXljb21w"
    "YW55LmNvbSIsICJleHAiOiAxNzQwOTAwMDAwLCAianRpIjogImFiYzEyMzQ1LXh5ei05ODc2In0"
)

# Restore padding before decoding (JWT deliberately omits '=')
padded = jwt_payload_b64 + "=" * (-len(jwt_payload_b64) % 4)

payload_bytes = base64.urlsafe_b64decode(padded)
payload = json.loads(payload_bytes.decode("utf-8"))

print(payload["role"])    # admin
print(payload["iss"])     # auth.mycompany.com
print(payload["user_id"]) # 2893

import base64

base64.b64decode("eyJ0eXBlIjogImFjY2VzcyJ9")
# binascii.Error: Incorrect padding

import base64
import json

def b64decode_unpadded(data: str | bytes) -> bytes:
    """Decode Base64 with automatic padding correction."""
    if isinstance(data, str):
        data = data.encode("ascii")
    data += b"=" * (-len(data) % 4)
    return base64.b64decode(data)

# Works regardless of how many '=' were stripped
token_a = "eyJ0eXBlIjogImFjY2VzcyJ9"       # 0 chars of padding stripped
token_b = "eyJ0eXBlIjogInJlZnJlc2gifQ"      # 1 char stripped
token_c = "eyJ0eXBlIjogImFwaV9rZXkifQ=="    # already padded

for token in (token_a, token_b, token_c):
    result = json.loads(b64decode_unpadded(token).decode("utf-8"))
    print(result["type"])
# access
# refresh
# api_key

import base64
import json

def decode_jwt_segment(segment: str) -> dict:
    """Decode a single JWT segment (header or payload)."""
    # Add padding, use URL-safe alphabet
    padded = segment + "=" * (-len(segment) % 4)
    raw = base64.urlsafe_b64decode(padded)
    return json.loads(raw.decode("utf-8"))

# Google OAuth ID token payload (simplified)
id_token_payload = (
    "eyJzdWIiOiAiMTEwNTY5NDkxMjM0NTY3ODkwMTIiLCAiZW1haWwiOiAic2FyYS5jaGVuQGV4"
    "YW1wbGUuY29tIiwgImhkIjogImV4YW1wbGUuY29tIiwgImlhdCI6IDE3NDA5MDAwMDB9"
)

claims = decode_jwt_segment(id_token_payload)
print(claims["email"])   # sara.chen@example.com
print(claims["hd"])      # example.com

import base64
import json
from pathlib import Path

def decode_attachment(envelope_path: str, output_path: str) -> None:
    """
    Read a JSON envelope with a Base64-encoded attachment,
    decode it, and write the binary output to disk.
    """
    try:
        envelope = json.loads(Path(envelope_path).read_text(encoding="utf-8"))
        encoded_data = envelope["attachment"]["data"]
        file_bytes = base64.b64decode(encoded_data, validate=True)
        Path(output_path).write_bytes(file_bytes)
        print(f"Saved {len(file_bytes):,} bytes → {output_path}")
    except FileNotFoundError:
        print(f"Envelope file not found: {envelope_path}")
    except (KeyError, TypeError):
        print("Unexpected envelope structure — 'attachment.data' missing")
    except base64.binascii.Error as exc:
        print(f"Invalid Base64 content: {exc}")

# Example envelope:
# {"attachment": {"filename": "invoice_2026_03.pdf", "data": "JVBERi0xLjQK..."}}
decode_attachment("order_ORD-88472.json", "invoice_2026_03.pdf")

import base64
import json
import urllib.request

def fetch_and_decode_secret(vault_url: str, secret_name: str) -> str:
    """
    Retrieve a Base64-encoded secret from an internal vault API
    and return the decoded plaintext value.
    """
    url = f"{vault_url}/v1/secrets/{secret_name}"
    req = urllib.request.Request(url, headers={"X-Vault-Token": "s.internal"})

    try:
        with urllib.request.urlopen(req, timeout=5) as resp:
            body = json.loads(resp.read().decode("utf-8"))
            # Vault returns: {"data": {"value": "<base64>", "encoding": "base64"}}
            encoded = body["data"]["value"]
            return base64.b64decode(encoded).decode("utf-8")

    except urllib.error.URLError as exc:
        raise RuntimeError(f"Vault unreachable: {exc}") from exc
    except (KeyError, UnicodeDecodeError, base64.binascii.Error) as exc:
        raise ValueError(f"Unexpected secret format: {exc}") from exc

# db_pass = fetch_and_decode_secret("https://vault.internal", "db-prod-password")
# print(db_pass)  # s4feP@ss!2026

# Decode a Base64 string and print the result (Linux / macOS)
echo "eyJob3N0IjogImRiLXByb2QubXljb21wYW55LmludGVybmFsIn0=" | base64 --decode
# {"host": "db-prod.mycompany.internal"}

# Decode a file, save decoded output
base64 --decode encoded_payload.txt > decoded_output.json

# Python's cross-platform CLI decoder (works on Windows too)
python3 -m base64 -d encoded_payload.txt

# Decode a JWT payload segment inline — strip header/signature first
echo "eyJ1c2VyX2lkIjogMjg5MywgInJvbGUiOiAiYWRtaW4ifQ" | python3 -c "
import sys, base64, json
s = sys.stdin.read().strip()
padded = s + '=' * (-len(s) % 4)
print(json.dumps(json.loads(base64.urlsafe_b64decode(padded)), indent=2))
"

import base64
import binascii
import re

# ── Option A: try/except (recommended for most code paths) ──────────────────

def safe_b64decode(data: str) -> bytes | None:
    """Return decoded bytes, or None if the input is not valid Base64."""
    try:
        padded = data + "=" * (-len(data) % 4)
        return base64.b64decode(padded, validate=True)
    except (binascii.Error, ValueError):
        return None

print(safe_b64decode("not-base64!!"))                     # None
print(safe_b64decode("eyJ0eXBlIjogInJlZnJlc2gifQ"))      # b'{"type": "refresh"}'


# ── Option B: regex pre-validation ──────────────────────────────────────────

# Standard Base64 (alphabet: A-Z a-z 0-9 + /)
_STANDARD_RE = re.compile(r"^[A-Za-z0-9+/]*={0,2}$")

# URL-safe Base64 (alphabet: A-Z a-z 0-9 - _)
_URLSAFE_RE = re.compile(r"^[A-Za-z0-9-_]*={0,2}$")

def is_valid_base64(s: str) -> bool:
    """True if s is a syntactically valid standard Base64 string."""
    # Length must be a multiple of 4 for fully padded strings
    stripped = s.rstrip("=")
    padded = stripped + "=" * (-len(stripped) % 4)
    return bool(_STANDARD_RE.match(padded))

print(is_valid_base64("SGVsbG8gV29ybGQ="))   # True
print(is_valid_base64("SGVsbG8gV29ybGQ!"))   # False  (! is not Base64)

pip install pybase64

import pybase64

# Drop-in replacement — identical API to the stdlib base64 module
encoded_image = "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAC0lEQVQI12NgAAIABQ..."

image_bytes = pybase64.b64decode(encoded_image, validate=False)
print(f"Decoded {len(image_bytes):,} bytes")

# URL-safe variant — same as base64.urlsafe_b64decode()
token_bytes = pybase64.urlsafe_b64decode("eyJpZCI6IDQ3MX0=")
print(token_bytes)  # b'{"id": 471}'

# Benchmark note: on strings under ~10 KB the function-call overhead dominates
# and the speedup is negligible. Profile before switching.

import base64

def decode_large_b64_file(input_path: str, output_path: str, chunk_size: int = 65536) -> None:
    """
    Decode a large Base64 file in chunks to avoid loading the entire encoded
    string into memory. chunk_size must be a multiple of 4 to keep Base64
    block boundaries aligned across reads.
    """
    assert chunk_size % 4 == 0, "chunk_size must be a multiple of 4"

    bytes_written = 0
    with open(input_path, "rb") as src, open(output_path, "wb") as dst:
        while True:
            chunk = src.read(chunk_size)
            if not chunk:
                break
            # Strip whitespace that may appear in wrapped/multiline Base64
            chunk = chunk.strip()
            if chunk:
                dst.write(base64.b64decode(chunk))
                bytes_written += len(chunk)

    print(f"Decoded {bytes_written:,} Base64 bytes → {output_path}")

# Example: decode a 300 MB database snapshot stored as Base64
decode_large_b64_file("snapshot_2026_03_13.b64", "snapshot_2026_03_13.sql.gz")

import base64

# base64.decodebytes() is designed for MIME / PEM Base64 that wraps at 76 chars.
# It silently ignores whitespace and newlines — perfect for certificate files.

with open("server_cert.pem", "rb") as f:
    pem_data = f.read()

# Strip PEM headers if present, then decode
lines = [
    line for line in pem_data.splitlines()
    if not line.startswith(b"-----")
]
raw_cert = base64.decodebytes(b"
".join(lines))
print(f"Certificate DER payload: {len(raw_cert):,} bytes")

import base64
from pathlib import Path

# Data URL from an <img src="..."> or an API response
data_url = (
    "data:image/png;base64,"
    "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAC0lEQVQI12NgAAIABQ=="
)

# Split off the "data:image/png;base64," prefix
_, encoded = data_url.split(",", 1)
image_bytes = base64.b64decode(encoded)
Path("avatar_elindqvist.png").write_bytes(image_bytes)
print(f"Saved {len(image_bytes)} bytes")