What is a Base64 decoder?
A Base64 decoder reverses Base64 encoding, turning a string of letters, digits, +, / and = back into the original bytes. This one then reads those bytes as UTF-8 text and shows you the result, which is what you want when inspecting an encoded token, an HTTP header, an email part or a config value.
Base64 is specified in RFC 4648. It's an encoding, not encryption, so decoding needs no key.
How to decode Base64
- Paste the Base64 string into the input box. Surrounding whitespace and line breaks are fine.
- Click Decode.
- Read or copy the text from the output panel.
Worked examples
| Base64 input | Decoded text | Note |
|---|---|---|
SGVsbG8sIFdvcmxkIQ== |
Hello, World! | Standard padded input |
SGVsbG8sIFdvcmxkIQ |
Hello, World! | Padding missing, still accepted |
Y2Fmw6k= |
café | Two UTF-8 bytes for é |
8J+RjQ== |
👍 | Four UTF-8 bytes for the emoji |
fn5+Pz8/ |
~~~??? | Uses both + and / |
fn5-Pz8_ |
Error | Same data in URL-safe form |
The last two rows are the same bytes in the two Base64 alphabets. The decoder only accepts the standard one.
How the input is cleaned up
The decoder uses the browser's atob(), which follows the WHATWG forgiving-base64 decode algorithm:
- All ASCII whitespace is removed first, including spaces and line breaks in the middle.
SGVs bG8=decodes toHello. - Up to two trailing
=are dropped if the length is a multiple of 4, and padding may be left off entirely. - The input is rejected if, after that, its length leaves a remainder of 1 when divided by 4 (a lone
Z, for example), or if it contains any character outsideA–Z a–z 0–9 + /.
Why valid Base64 can still show an error
After decoding, the bytes are interpreted as UTF-8. If they aren't valid UTF-8, you'll see "This is not valid Base64." even though the Base64 itself decoded fine. Two common causes:
- Binary data. Base64 of a PNG, PDF or ZIP file contains bytes that don't form UTF-8 text. For example,
iVBORw0KGgo=is the start of every PNG file and is rejected here. Use a tool built for images, or decode it in code. - Latin-1 text.
Y2Fm6Q==is "café" encoded with a single byte (0xE9) for é, as older Windows and ISO-8859-1 systems do. That byte isn't valid UTF-8 on its own, so it's rejected. The UTF-8 version,Y2Fmw6k=, decodes fine.
If your Base64 came from a JWT, note that JWTs use the URL-safe alphabet without padding (RFC 7515). Swap - for + and _ for / in the header or payload segment before decoding it here, and don't paste the signature segment, which is binary.
Decoding safely
Base64 hides nothing. If you find credentials in a decoded Authorization: Basic header or a config file, treat them as exposed. And remember that decoded text is just text: this page displays it in a read-only box and never runs it.
Related tools
- Base64 encoder: the reverse direction, text to Base64.
- Image to Base64: create data URLs from image files.
- URL decoder: for
%20-style percent-encoding, which is often confused with Base64. - Text to binary: see the bits behind each character.
Last updated