Base64 Decoder

Decoding Base64 back to text or files

Base64 strings turn up everywhere: in API responses and webhooks, email source (Content-Transfer-Encoding: base64), Kubernetes secrets, Authorization: Basic headers, SAML messages and data URIs. Decoding turns the text back into the original bytes — which may be readable text, or an image, PDF or ZIP file.

Real-world Base64 is rarely tidy, so this decoder is forgiving where it is safe to be: it accepts the standard and URL-safe (base64url) alphabets, ignores line breaks and spaces from wrapped MIME or PEM data, adds missing = padding, and strips a data: URI prefix while keeping its media type. Where the input is genuinely broken, it says why and shows the exact position of the first invalid character.

The decoded bytes are checked for valid UTF-8. Text is shown as text; anything else gets a hex dump, and known formats (PNG, JPEG, GIF, WebP, PDF, ZIP and more) are identified from their magic bytes, previewed if they are images and offered as a download with the right file extension.

How to use the Base64 Decoder

1. Paste the Base64 string, base64url token or complete data: URI into the input box, or click Sample.
2. Read the decoded text on the right. If the input has an error, the message names the problem and points at the character.
3. If the result is binary, switch between Text and Hex dump, or change the character encoding if the text came from a legacy system.
4. Click Download to save the decoded bytes as a file. Images are previewed below the input.

Example

A Basic authentication header contains Base64 of username:password. Decoding the value after Basic reveals it in plain text — which is why Basic auth must only be used over HTTPS:

Input:  YWxhZGRpbjpvcGVuc2VzYW1l
Output: aladdin:opensesame

Decoding JWT payloads

A JSON Web Token is three base64url segments separated by dots: header, payload and signature. Paste a whole token and this tool decodes the header and payload as JSON and lists the iat, nbf and exp times in UTC.

Decoding is not verifying. The payload of a standard JWT is only encoded, not encrypted, so anyone holding the token can read it — never put secrets in it. Equally, a decoded token proves nothing: a server must verify the signature with the correct key and algorithm, and reject alg: none, before trusting any claim.

Common decoding errors

• Invalid character `.`: you probably pasted a JWT segment with the dots, or a domain name. Decode each segment separately.
• Invalid character `%`: the string was URL-encoded after Base64 encoding (%2B, %3D). Run it through the URL Decoder first.
• Length of 4n+1: one character is missing or extra, typically from a copy-paste that cut the string short.
• Garbled accents in the text: the original was encoded from Latin-1 or UTF-16 rather than UTF-8. Switch the character encoding.