Base64 Decode and Encode

How it works

Base64 writes any data, text or files, with 64 safe characters: A–Z, a–z, 0–9, + and /. Every 3 bytes become 4 characters, so Base64 is about a third larger than the data it holds. Decoding reverses that. Everything runs in your browser: nothing you paste is uploaded, which matters when the Base64 holds a token or a private file.

What the decoder fixes for you

Base64 copied from emails, logs, code and web pages is rarely clean. The decoder:

• skips spaces and line breaks, like the line every 76 characters in email attachments,
• reads URL-safe Base64, which uses - and _ instead of + and /,
• adds missing = padding at the end, which JWTs and many APIs leave out,
• removes a data: URL prefix, like data:image/png;base64,.

The notes under the result list what it fixed. When something can’t be fixed, like a character that isn’t Base64 or text after the = padding, the tool shows the exact line and column.

Text, images and files

If the decoded bytes are UTF-8 text, you see the text. Text in an older encoding is read as Windows-1252 (Latin-1), with a note.

If they are a file, the tool recognizes common types by their first bytes: PNG, JPEG, GIF, WebP, SVG and ICO images, PDF, ZIP (including Word, Excel and PowerPoint files), gzip, MP3, MP4, WOFF and WOFF2 fonts. Images get a preview with their size in pixels, and every file gets a Download button. The result box shows the first 1,024 bytes in hex, which is how developers usually inspect binary data.

Encoding

Choose Encode to turn text into Base64. The text is turned into UTF-8 bytes first, so accented letters and emoji come back exactly as typed when the Base64 is decoded.

• URL-safe (- and _, no =) makes Base64 you can put in a web address or a file name without escaping.
• Line break every 76 characters matches the format email (MIME) uses for attachments.

Base64 isn’t encryption

Anyone can decode Base64, so it hides nothing. A JWT’s payload, for example, is readable by anyone who has the token: decoding it here shows what it contains, but doesn’t check that its signature is valid.