Base64 Decode

Private: nothing leaves your browser

URL safe alphabet

Your text

Result

output

Waiting for text

Paste Base64 and read it back as text. It decodes as you type, handles the URL safe alphabet that JSON Web Tokens use, and copes with missing padding and line breaks. Accented letters and emoji come back intact.

About decoding Base64

Base64 turns up wherever bytes have to travel through something that only carries text: a JSON Web Token, an email header, a data URI in a stylesheet, an API response, a Kubernetes secret. It is an encoding, not encryption, so anything encoded this way can be read back by anyone. That is exactly what this page does.

Two things break most other decoders. The first is padding: the URL safe form used in tokens drops the trailing = signs, and a strict decoder then refuses the input. This puts the padding back for you and accepts - and _ as well as + and /, so you never have to work out which variant you are holding. The second is text that is not plain English: a naive decoder mangles anything outside Latin-1, while this decodes the real UTF-8 bytes, so a name with an accent or a message with an emoji survives.

If the string does not decode to readable text, the status line says why rather than quietly handing back rubbish: an illegal character is named, and a payload that decodes to bytes but not to text is reported as such. Raw binary, such as an image, is not readable text and is not meant to be.

How to decode Base64

Paste your Base64 into the box. Nothing else to press: the result is already there.
The direction is worked out from what you paste, so plain text gets encoded instead. Use Encode or Decode to overrule it.
Press Copy to take the decoded text.
Press Result to input to send it back through the other way and confirm it round trips.
For a JSON Web Token, paste one dot separated chunk at a time, or use the JWT decoder, which splits all three for you and labels every claim.

Common questions about Base64 decoding

Is it safe to decode a token or a secret here?

No. The decoding is JavaScript running on this page, so tokens, payloads and secrets stay on your own device. Nothing is sent, logged or saved, and the page keeps working with your connection switched off.

Can I decode a JWT with this?

Yes, one part at a time. A JWT is three URL safe Base64 chunks separated by dots. Paste the first chunk to see the header and the second to see the payload. The third is a signature over raw bytes, so it will not decode to readable text, and verifying it needs the signing key.

Why does my string say it is not valid Base64?

Usually one of three things: a character that got mangled in transit, a chunk that was copied incompletely, or a fragment whose length is not a whole number of Base64 blocks. The status line names the offending character when there is one. Missing padding and line breaks are not a problem here, because both are handled for you.

It decoded, but the result is gibberish. Why?

Then the original was not text. An image, a certificate, a compressed archive or an encrypted blob all encode perfectly well into Base64 and all decode into bytes that mean nothing on screen. If the bytes are not valid UTF-8 text this page tells you so instead of showing replacement characters.

Is Base64 a way of hiding data?

No, and treating it as one is a common and expensive mistake. Anyone can decode it, with no key and no effort, exactly as this page just did. Never use it to hide a password, an API key or personal data. It is for transport, not for secrecy.

Related tools

All Dev tools

Base64 Encode Encode text or a file to Base64, or to a data URI. URL Decode Decode a percent encoded URL or query value back to plain text. JSON Formatter Format, validate and minify JSON with clear error positions. JWT Decoder Read a token's header, payload and expiry. Nothing is sent anywhere.