Decode any Base64 string to text, hex, or binary. Live mode, URL-safe handling, 50+ character sets. 100% browser-based — your data never leaves the page.
Most Base64 tools are either bare-bones (paste → result, no options) or buried in enterprise feature creep. This sits right in the middle — built for developers debugging API payloads, security folks reviewing tokens, and anyone who just got a Base64 string in an email and needs to see what's inside.
Drop your encoded text into the input area. Whitespace, line breaks, and missing padding are all handled automatically. Standard and URL-safe formats both work.
UTF-8 covers virtually all modern text. If the original was encoded on an older Windows or regional system, choose the matching ISO-8859, Shift-JIS, or Big5 variant from the dropdown.
Click Decode — or flip on Live mode and watch the output update as you type. Copy the result, share a link, or move straight into encoding the next thing.
+ and / characters, which have special meaning in URLs. URL-safe Base64 (RFC 4648) replaces + with - and / with _ so the encoded string can be used safely in URLs and filenames. Our decoder auto-detects and handles both formats. Full explainer →+, /, and = (padding). If your input has spaces, newlines, or other characters, try removing them. Also check that the total length is a multiple of 4 — if not, padding (=) may be missing. Our tool ignores whitespace and tolerates missing padding automatically. Troubleshooting guide →= signs are appended so the output length is a multiple of 4. One = means one byte of padding; two == means two.Base64 is a method of representing arbitrary binary data — bytes that may include unprintable characters, control codes, and high-bit values — using only 64 printable ASCII characters. It exists because computers send a lot of binary data (images, audio, encrypted blobs) through systems that were originally designed for text (email, JSON, URLs, HTML attributes). Base64 is the bridge: it turns binary into text on the way in, and back into binary on the way out.
The encoding works in fixed-size groups. Three input bytes (24 bits) become four output characters (each representing 6 bits). The 64 characters in the standard alphabet are A-Z, a-z, 0-9, +, and /. The padding character = fills out the final group when the input length is not divisible by 3. This is RFC 4648, and it has been the dominant standard since 2006.
You will encounter Base64-encoded data in dozens of everyday contexts. JSON Web Tokens use three Base64-encoded segments to package authentication claims. Data URIs inline small images and fonts directly into HTML and CSS. HTTP Basic Auth headers Base64-encode the username and password (one of the original sins of HTTP security, but still widely used). API responses often return binary content — PDFs, images, ZIP files — embedded as Base64 inside JSON. Email attachments travel through SMTP as Base64-encoded MIME parts. SSL/TLS certificates in PEM format are Base64-encoded DER bytes wrapped between BEGIN/END markers. Configuration files like Kubernetes secrets and Docker Compose volumes sometimes embed binary content as Base64.
If you are debugging a system, inspecting an API response, reverse-engineering a webhook payload, or simply curious what some long string of letters and digits represents, you need a Base64 decoder. This tool handles all the common cases and many of the rare ones.
Paste your Base64 string into the input box at the top of this page. The decoder runs immediately if "Live mode" is enabled, or after you press the Decode button. The decoded result appears in the output box, and the stats panel on the right shows the input length, output length, detected format (standard or URL-safe), padding state, and decoding status.
Three knobs control the decoding behavior. Destination character set determines how the decoded bytes are interpreted as text. UTF-8 is the default and handles most modern content correctly, including emoji and non-Latin scripts. If your decoded text looks like garbage, the original was almost certainly encoded with a different character set — Windows-1252 (Western European text from Windows systems), Shift-JIS (Japanese), GBK (Simplified Chinese), or ISO-8859-1 (Latin-1) are common alternatives. The decoder supports 50+ character sets to cover virtually any legacy content.
Decode each line separately processes multi-line inputs by treating each line as an independent Base64 string. Useful when you have a list of Base64 entries (one per line) rather than a single multi-line Base64 value. Strict mode disables the decoder's normal tolerance — it will reject input that contains whitespace, URL-safe characters, or missing padding. Use this when you need to verify that a Base64 string conforms to RFC 4648 §4 exactly, useful for API request validation.
The output format selector lets you view the decoded bytes in five different ways. Text (default) interprets the bytes as characters using your chosen character set. Best for human-readable content. Hex shows each byte as a two-digit hexadecimal value, space-separated, wrapped at 48 characters per line. Useful for inspecting binary structure and verifying byte sequences. Hex uppercase is the same but uppercase, with no separators — the form some debuggers and protocol traces prefer. Hexdump shows the offset, hex bytes, and ASCII rendering side-by-side — the classic output of Unix's xxd command, ideal for analyzing file formats and protocol packets. Bytes summary shows the length, the first 16 bytes in hex, and the detected MIME type from the magic-byte signature — quickest way to check whether your Base64 represents an image, PDF, or text.
Not all Base64 represents text. If your input encodes an image (PNG, JPEG, GIF, WebP, BMP, SVG), the decoded bytes will look like gibberish in the text output box — but the preview card below the output will detect the format from the magic bytes and render the image inline. You can download the binary as a file or copy it as a data URI.
The same applies to PDFs, compressed archives, audio, and video. The bytes-summary output mode is the fastest way to figure out what you actually have: it identifies image/png, application/pdf, application/zip, audio/mpeg, video/mp4, and several other formats from their first few bytes. If your data does not match a known format, the summary shows the first 16 hex bytes so you can investigate further or check against a magic-byte reference.
"Input contains characters that are not valid Base64." The string includes characters outside the Base64 alphabet — often a stray quote, a comma, an angle bracket, or invisible Unicode whitespace from a copy-paste. Remove the offending characters or use permissive mode (the default), which silently ignores most stray characters.
"Invalid length — Base64 length must be a multiple of 4." Standard Base64 is always a length that is divisible by 4 after padding. If your string is shorter, padding was likely stripped — the decoder normally fixes this automatically in permissive mode. In strict mode, you will need to add the correct number of = characters yourself.
The decoded text is partially correct but has odd characters. Wrong character set. Try switching from UTF-8 to Windows-1252, ISO-8859-1, or a regional charset matching the source system. The bytes-summary output mode helps verify whether the decoded data is actually text at all.
The decoded "text" is random-looking gibberish. The Base64 likely encodes binary data, not text. Switch to hexdump or bytes-summary output mode to see what you actually have. The image-preview card at the bottom of the page automatically detects images and renders them.
RFC 4648 defines two Base64 alphabets. The standard alphabet (§4) uses + and / for positions 62 and 63. The URL-safe alphabet (§5) substitutes - and _ to avoid the special meaning those characters have in URLs and filenames. The URL-safe variant is required by JSON Web Tokens, OAuth 2.0 PKCE challenges, and other URL-embedded encodings.
This decoder accepts both variants automatically — there is no separate URL-safe mode to toggle. The decoder detects URL-safe characters (- or _) and converts them to standard characters internally before decoding. The stats panel shows the detected format so you know which variant your input is.
For Base64 content larger than a few thousand characters, paste-and-decode becomes unwieldy. Drop a file onto the upload zone below the decoder, and the tool reads it directly. If the file looks like Base64 text (mostly Base64-alphabet characters, possibly with PEM headers), it is auto-decoded. If it looks binary, the decoder switches to encode mode and produces a Base64 representation of the file.
File support extends to 50 MB. For very large Base64 inputs (over 200 KB), the decoder switches to a chunked algorithm that processes the data in 64 KB pieces, yielding to the browser between chunks so the UI stays responsive. Progress is shown in the stats panel.
Nowhere. This decoder runs entirely in your browser using JavaScript. The Base64 string, the decoded output, and any uploaded files exist only in your browser tab. There is no server-side decoding, no analytics that capture your input, no logging. You can verify this by opening your browser's DevTools, switching to the Network tab, and watching what happens when you paste and decode — the Network tab will stay completely silent.
The page loads from our server once (about 200 KB of HTML, CSS, and JS) and runs entirely offline thereafter. Disconnect your network and the decoder still works. This is the kind of tool that should be a static file you can save locally if you want — and you can. View source, save the page, run it locally. It will work identically.