Base64 Decode

Decode Base64 strings back to readable text, or encode any text into Base64 — instantly, in your browser. Standard and URL-safe input are both supported, and nothing you paste ever leaves your device.

0 words0 characters0 lines

Why This Tool Matters

Base64 shows up constantly in day-to-day development, usually as an opaque blob you need to see inside. A developer debugging an auth issue pastes the middle segment of a JWT to check which claims and expiry time it actually carries. Someone reading a raw email source wants to know what an encoded attachment header or subject line says. A front-end developer finds a data URI in a stylesheet and wants to confirm it's the SVG they expect, or an ops engineer needs to read a secret stored Base64-encoded in a Kubernetes manifest. In each case the answer is one decode away — and because this tool runs entirely in your browser, you can inspect tokens and credentials without pasting them into someone else's server.

Encoding is just as routine: embedding a small string in a URL parameter or config file where special characters would otherwise break parsing, building a Basic Auth header from "user:password", or preparing a value for an environment variable. The tool encodes text as UTF-8 first, so accented letters, non-Latin scripts, and emoji round-trip correctly — something the browser's own btoa() function can't do on its own. Toggle between Encode and Decode and the result carries over as the new input, so you can confirm a value round-trips before shipping it.

How to Use

  1. 01

    Pick a direction

    Decode is selected by default — switch to Encode to go the other way.

  2. 02

    Paste your text

    Enter a Base64 string or plain text — the result updates live.

  3. 03

    Copy the result

    Copy the output, or toggle modes to round-trip it.

More Text Tools

Frequently Asked Questions

What is Base64 encoding used for?

Base64 turns arbitrary bytes into plain ASCII letters, digits, "+", and "/", so binary data can travel safely through systems built for text. You'll see it in email attachments (MIME), data URIs that embed images directly in HTML or CSS, JSON Web Tokens, HTTP Basic Authentication headers, API keys and secrets in config files, and anywhere binary data needs to sit inside JSON, XML, or a URL.

Why does decoding sometimes show an error?

Usually for one of three reasons. The input contains characters that aren't part of Base64 — often a stray quote, bracket, or part of the surrounding code copied by accident. The string was cut off mid-copy, leaving a length that can't form complete characters. Or the Base64 is perfectly valid but decodes to binary data, like an image or a zip file, rather than readable text. The message under the result tells you which one it is.

Does this handle URL-safe Base64 (with - and _ instead of + and /)?

Yes, when decoding. URL-safe Base64 (used in JWTs and many web APIs) replaces "+" with "-" and "/" with "_", and usually drops the trailing "=" padding. The decoder accepts both alphabets and restores missing padding automatically, so you can paste either form. Encoding always produces standard Base64 with padding.

Can I decode a Base64 image (data URI)?

You can paste a full data URI such as "data:image/png;base64,iVBOR…" — the prefix is stripped automatically. But because this is a text tool, image and file data can't be displayed as readable text; you'll see a message telling you the input decodes to binary data and how many bytes it contains. Data URIs that hold text, like "data:text/plain;base64,…" or an inline SVG, decode to readable output normally.

Is Base64 the same as encryption?

No. Base64 is an encoding, not encryption — there's no key or secret involved, and anyone can decode it instantly, exactly as this tool does. It exists to make data safe to transport as text, not to hide it. If a password, token, or API key is "protected" only by Base64, treat it as plain text.

Is my text sent to a server when I use this tool?

No. Encoding and decoding both run entirely in your browser using built-in JavaScript functions. Nothing you paste is uploaded, logged, or stored, which makes it safe to inspect tokens, credentials, and other sensitive strings — and the tool keeps working even if you go offline after the page loads.