How to decode Base64
- Paste your Base64 string into the box above.
- Leave any quotes or line breaks in place. The tool cleans them.
- Read the decoded text that appears right away.
- Split a token on its dots first if you are reading a JWT.
- Copy the result or download it.
What this Base64 decoder handles
- URL safe strings that use hyphen and underscore.
- Strings with no padding which tokens often leave out.
- Line breaks and indents from a wrapped block.
- Quotes and trailing punctuation copied from source code.
- A data URI prefix that the tool strips first.
- Full UTF-8 output so accents and emoji come back right.
Base64 strings turn up everywhere
Encoded data hides all over the systems you use. An Authorization header holds Base64 credentials. A JSON Web Token is three Base64 parts joined by dots. A config file may hold a certificate between PEM markers. An API may return a whole file as a Base64 string. A stylesheet may carry a data URI for an icon.
A Base64 decoder shows what each one actually says. That is often the fastest way to learn why something does not work.
Why decoders fail on real strings
Strings copied from production are rarely clean. They arrive wrapped in quotes from a source file. A terminal splits them across lines. The padding is missing because the sender used the URL safe form. A data URI prefix is still attached.
A strict decoder rejects all of these. This tool cleans the input first.
- It strips a data URI prefix.
- It removes quotes and trailing punctuation.
- It drops spaces and line breaks.
- It turns URL safe characters back into standard ones.
- It adds back any missing padding.
Then it decodes. That makes the difference between a tool for textbook input and a tool for real work.
How to read a JSON Web Token
A JWT looks like xxxxx.yyyyy.zzzzz. The first two parts hold JSON in URL safe Base64. They are the header and the payload. Decode them to see the claims and the expiry time. The third part is a binary signature. It never decodes to readable text.
Split the token on the dots and decode each part alone. Then run the result through the JSON formatter to read it clearly. Remember one thing. Anyone who holds a token can read its payload. So never put secrets inside one.
When the output looks like nonsense
| Cause | What to do |
|---|---|
| Binary data such as an image or archive | Use a file decoder instead of a text decoder |
| Double encoding | Decode the result a second time |
| Encrypted data | You need the key and no decoder can help |
| Text cut short when copied | Copy the full string again |
Was the string an image? The Base64 to image converter turns it back into a file with a preview.
Common Base64 decoder questions
Is padding required?
Standard Base64 pads with equals signs to a multiple of four. URL safe output usually skips the padding. This tool adds it back on its own.
Why do some letters look wrong?
The sender may have used an old text encoding. This tool reads UTF-8 which covers almost all modern data.
Base64 versus Base64URL
The two forms differ in only two characters. Standard Base64 uses a plus and a slash. Base64URL uses a hyphen and an underscore. Base64URL also tends to skip the padding at the end. A strict decoder rejects one form or the other. This tool accepts both and you never need to pick.
Tips for safe decoding
- Treat any decoded password or key as exposed.
- Rotate a secret if you find it in a public string.
- Check token expiry times before you blame other code.
- Keep decoded data out of chat apps and tickets.
A quick Base64 decoder example
Paste SGVsbG8gd29ybGQ= into the box. The tool shows "Hello world" right away. Now remove the equals sign at the end. The result stays the same. The tool adds the missing padding for you. Wrap the string in quotes and it still works.
Who uses a Base64 decoder?
Developers read tokens and API responses. Security teams check suspicious strings. Support staff read encoded logs. Students learn how encoding works.
Your data stays private
The text you paste never leaves your browser. That matters because these strings often hold credentials. Need to go the other way? Use the Base64 encoder. Got a percent encoded link instead? Try the URL decoder.