Base64 Decoder
Decode Base64 or Base64URL strings back to plain text, entirely client-side.
What is Base64 decoding?
Decoding reverses Base64 encoding: it takes text made of the 64-character alphabet (A–Z, a–z, 0–9, + and /, or − and _ for the URL-safe variant) and converts it back into the original bytes. It's commonly needed when inspecting JWT header/payload segments, API responses, email attachments, or data URIs.
How it works
Each group of 4 Base64 characters (24 bits) is split back into 3 bytes. This tool uses the browser's native atob() function after normalizing URL-safe characters and restoring any stripped padding, then decodes the resulting byte sequence as UTF-8 text with TextDecoder.
Worked example
Decoding SGVsbG8sIHdvcmxkIQ== yields Hello, world!. If you instead paste a JWT payload segment like eyJzdWIiOiIxMjM0NTY3ODkwIn0 with the JWT-style toggle enabled, you'll see the raw JSON claims — exactly what the JWT Decoder shows for the payload portion.
Common mistakes
- Pasting a full three-part JWT here instead of a single segment — decode each dot-separated part separately, or use the JWT Decoder.
- Forgetting to toggle "Base64URL" mode when the string contains
-or_. - Assuming decoded output is always readable text — binary data will look like garbage characters, which is expected.
- Confusing decode errors with signature-invalid errors — a Base64 decode error is purely a formatting issue.
Security notes
Decoding happens entirely in-browser; nothing is uploaded. Because Base64 offers no confidentiality, treat any "hidden" data revealed here as already public — don't rely on encoding alone to protect sensitive information.
Code examples
const decoded = atob("SGVsbG8sIHdvcmxkIQ==");
// "Hello, world!"import base64
print(base64.b64decode("SGVsbG8sIHdvcmxkIQ==").decode())Base64 Decoder FAQ
Why do I get an error decoding my string?
The most common cause is invalid characters or incorrect padding. If your string uses '-' and '_' instead of '+' and '/', it's Base64URL — enable the toggle below to decode it correctly.
Can I decode a JWT header or payload here?
Yes — paste a single JWT segment (not the full dot-separated token) with the Base64URL toggle on to see the raw JSON. For full token inspection, use the dedicated JWT Decoder.
What happens to non-text (binary) data?
This tool assumes UTF-8 text output. If the decoded bytes aren't valid UTF-8 (e.g. an image), you'll see garbled characters — that's expected for binary payloads.
Does decoding verify a signature or checksum?
No. Base64 decoding simply reverses the encoding; it performs no integrity or authenticity check. Verifying a JWT signature requires the Validator or a server-side library.
Is decoding a security check?
No — anyone can decode Base64 instantly. Never assume Base64-encoded data is private or protected.
Why is padding sometimes missing?
Base64URL (used in JWTs) commonly omits the trailing '=' padding characters. This tool automatically re-adds padding as needed when the URL-safe toggle is enabled.