Encoding Tools

Base64 Decoder

Inspect and decode Base64 payloads without leaving your browser.

Base64 input

Decoded text

Encode this developer note.

Understand the format

How Base64 Decoder works

Decoding reverses the 6-bit packing and then interprets the recovered bytes as UTF-8 text, which tells you immediately whether a string was ever text at all.

What decoding can and cannot tell you

Decoding recovers the original bytes exactly. Whether those bytes are meaningful text is a separate question. A Base64 string may unpack into a PNG header, a gzip stream, a protocol buffer, or an encrypted blob, in which case the decoded output looks like noise. That is still a useful result: it tells you the value was never plain text and that another step is needed.

A quick heuristic before decoding: standard Base64 contains only A-Z, a-z, 0-9, plus, slash, and trailing equals signs, and its length is a multiple of four. If a string contains hyphens or underscores it is probably URL-safe Base64, and if it contains three dot-separated segments it is probably a JWT.

Tolerant input handling

This decoder normalises common variations before decoding: whitespace and line breaks are stripped, the URL-safe characters - and _ are converted back to + and /, and missing padding is restored. That means a value copied out of a wrapped email header, a URL query parameter, or a JWT segment usually decodes without manual cleanup.

If decoding still fails, the input is genuinely not valid Base64. The usual causes are a truncated copy, a stray character picked up from the surrounding text, or a value that was double-encoded and needs a second pass.

Step by step

How to use Base64 Decoder

Paste the encoded string into the left panel; line breaks and missing padding are handled for you.
Read the decoded text on the right, or the error banner if the input is not valid Base64.
If the result still looks encoded, decode it again; values are sometimes encoded twice as they cross system boundaries.
If the result is unreadable, treat it as binary data such as a compressed or encrypted payload rather than text.

Decoding uses the browser atob and TextDecoder APIs in the page, so encoded credentials and internal payloads stay on your machine.

Worked examples

Base64 Decoder examples explained

A JWT header segment

Input

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9

Result

{"alg":"HS256","typ":"JWT"}

Every JWT begins with a Base64URL-encoded JSON header. Seeing eyJ at the start of a string is a reliable hint that the decoded value begins with {".

Basic authentication credentials recovered

Input

dXNlcjpwYTU1d29yZA==

Result

user:pa55word

A concrete demonstration that Base64 offers no protection: the credentials come straight back out.

Reference

Reading a Base64-looking string before you decode it

Reading a Base64-looking string before you decode it
Clue	Likely format	Next step
Starts with eyJ	JSON encoded as Base64	Decode, then format the JSON.
Three parts separated by dots	JSON Web Token	Use the JWT decoder instead.
Contains - or _ and no padding	URL-safe Base64	Decodes here; the variant is normalised automatically.
Length not a multiple of four	Padding stripped or value truncated	Padding is restored; if it still fails, the copy is incomplete.
Decodes into unreadable characters	Binary, compressed, or encrypted data	Identify the container format before going further.

Practical Guide

How teams use Base64 Decoder

Common use cases

Read encoded configuration fragments and fixture values.
Inspect copied header values while debugging authentication.
Confirm whether a suspicious string is simply encoded text rather than an opaque identifier.

Checks before trusting the result

A decoded value may still be compressed, serialised, or encrypted and need another step.
Treat decoded secrets carefully even though the processing happened locally.
If decoding fails, check for a truncated copy before assuming the source system is at fault.

Troubleshooting

Common mistakes and how to fix them

Decoding a JWT segment and concluding the token is valid.: Decoding proves nothing about the signature. Verification requires the signing key and must happen server-side.
Assuming garbled output means the decoder failed.: If the input decoded without an error, the bytes are correct. The value simply was not UTF-8 text.
Pasting a value that includes a surrounding quote or trailing comma from a config file.: Strip the delimiters. A single extra character changes the bit alignment of everything after it.

FAQ

Base64 Decoder questions, answered

Why does my string fail to decode?

Usually a truncated copy or an unexpected character from the surrounding text. Padding, whitespace, and the URL-safe alphabet are all normalised automatically, so those are not the cause here.

Can I decode a JWT here?

You can decode any single segment, but the JWT decoder splits the token and formats the header and payload for you, including converting the timestamps.

The output contains question marks and boxes. What happened?

The bytes are not valid UTF-8 text. That normally means the original data was binary, for example an image, an archive, or ciphertext.

Is decoding reversible?

Completely. Encoding and decoding are exact inverses, which is precisely why Base64 must never be relied on for confidentiality.

Does the decoder handle Base64 without padding?

Yes. Missing = characters are restored before decoding, which is what makes JWT segments and URL parameters work directly.

Go deeper

Specifications and guides

Base64, Hex, and Percent-Encoding Compared — Three encodings, three jobs. How to tell them apart, when each is correct, and why none of them protects data.
JWT Claims, Expiration, and Safe Token Inspection — What to inspect in a JWT and what not to trust when you are debugging auth.