What a Base64 decoder does
Decoding is the inverse of encoding. The decoder groups the Base64 characters into fours, turns each group back into three bytes, and stops at the padding. What you see next depends on those bytes: if they are UTF-8 text you get readable words, and if they are a file or an encrypted value you get an explanation instead.
The part that trips people up is character set. Base64 stores bytes, not letters. A decoder has to know which character set those bytes belong to before it can show text, and for modern web and API data the answer is UTF-8. This decoder assumes UTF-8, validates the result, and rejects values whose bytes are not valid UTF-8 rather than printing replacement characters.
What this decoder accepts
The input box is deliberately forgiving. It removes whitespace, normalizes URL-safe characters and strips a data URL prefix before decoding, so the value usually works as pasted.
- Plain Base64 with or without
=padding. - URL-safe Base64 that uses
-and_instead of+and/, as found in JWT segments and many APIs. - MIME-style values wrapped at 76 characters, including the line breaks that email clients insert.
- Complete
data:URLs such asdata:image/png;base64,iVBORw0…. The prefix is removed automatically; image data is reported as binary rather than shown as text. - Multi-line pastes where only one line is the encoded value: the decoder removes whitespace but will reject unrelated text mixed into the same line, and the error names the offending character.
Where developers meet Base64
| Source | What the encoded part is | What this decoder shows |
|---|---|---|
| JWT (JSON Web Token) | The header and payload segments, Base64URL encoded | The JSON header and claims, so you can read the algorithm and expiry fields |
| data: URLs | A media type plus the file contents in Base64 | Text payloads in full; binary payloads are identified as binary |
| HTTP Basic authentication | base64(username:password) after the word Basic | The username and password in plain text — treat such values as secrets |
| Email attachments | MIME Base64 with 76-character line wrapping | Text attachments decode directly; files need a file decoder |
| API and log payloads | Binary or JSON bytes packed into a string field | Readable JSON or plain text, with a clear failure when the bytes are binary |
Decoder, encoder and converter: what is the difference?
An encoder turns readable input into Base64; a decoder turns Base64 back into readable output. Most online tools do both in one box and call themselves converters, which is convenient but hides which direction will run. This page opens with the directional buttons ready, and the encoder for the same input sits one click away on the Base64 decode page and the home page.
If you need the reverse operation on this input, use Encode to Base64 in the same tool. It encodes whatever is currently in the box, so moving the decoded result into the input with Use result as input gives you a round-trip check.
Why local decoding matters for tokens
The values people decode are often sensitive: a JWT with a customer identifier, an API response with personal data, a Basic authentication header. Pasting one into a server-backed tool sends the secret to a third party and usually into a log. That is a real risk, not a theoretical one.
This decoder runs entirely in the page. There is no request behind the button, so the value never leaves the tab, and you can watch the network panel while decoding to confirm it. The same property means the tool keeps working offline once the page has loaded.
Frequently asked questions
Can I decode a JWT with this tool?
You can decode the header and payload, but not the signature. Split the token at the dots and paste either of the first two segments; the decoder handles their URL-safe alphabet and returns readable JSON. The third segment is a binary signature, so it is correctly reported as binary, and this tool does not verify the signature or validate the token.
Can I decode a data:image/png;base64 value here?
The decoder strips the data: prefix and decodes the payload, but image bytes are binary, so there is no readable text to display and the tool will tell you that. To turn the value into a file, save the encoded payload as a .b64 text file and decode it with base64 --decode on the command line.
What is the difference between a Base64 decoder and a Base64 encoder?
The encoder goes from readable text to Base64; the decoder goes from Base64 to readable text. They are inverse operations, so encoding then decoding should return the original string exactly. This page opens with the decode button highlighted, and the same tool encodes any text you put in the box.
Does the decoder accept URL-safe Base64?
Yes. The characters - and _ are mapped back to + and / before decoding, and missing padding is recalculated. That makes it safe to paste values from query strings, filenames, JWT segments and any API that uses the URL-safe variant without editing.
Is my data sent to a server?
No. The decoder is JavaScript that runs in your browser and makes no network requests. The text you paste exists only in the tab's memory, disappears when the page is reloaded, and is never logged by this site.