Paste Base64 to turn it back into UTF-8 text. Whitespace and MIME line breaks are stripped first; 4 characters decode to 3 bytes. A string containing - or _ is Base64URL (every JWT segment): turn on URL-safe. Length mod 4 equal to 1 means characters were lost. Non-UTF-8 bytes are shown as hex. Decoding stays in this tab.
Runs in this tab · nothing is uploaded · Verify in 10 seconds →
Decoding reverses the 4-characters-to-3-bytes mapping of RFC 4648: whitespace and line breaks are stripped first (MIME wraps encoded blobs at 76 characters), the Base64 is converted back to bytes, and the bytes are decoded as UTF-8 text. A valid Base64 string's length is always a multiple of 4 after padding, length mod 4 equal to 1 is impossible and means characters were lost.
One structural fact solves most decode failures: standard Base64 uses “+” and “/” at alphabet positions 62 and 63, while Base64URL uses “-” and “_” and usually drops the “=” padding. A string containing “-” or “_” (every JWT segment, for example) is Base64URL and fails strict standard decoders until the two characters are swapped back and padding restored.
The error names the cause. “That looks like Base64URL (it contains “-” or “_”). Turn on URL-safe to decode it.” is the most common, every JWT segment triggers it. “That string is not valid Base64: its length mod 4 is 1, so at least one character is missing.” means the paste was truncated, and “… is not in the alphabet.” means a stray character rode along. If decoding succeeds but the Hex toggle switches on with “Decoded bytes are not valid UTF-8, showing hex.”, the original bytes were not text: a PNG or gzip payload decodes fine as bytes but is not UTF-8 prose; use File mode to save it as a file.
Decode when you meet an opaque blob: a Basic auth header, a data: URL, an encoded config value, an email attachment segment.
This page is a focused view of theBase64 Encode / Decode: Text, Images & Files, which has the full set of options.
Usually the string is actually Base64URL (contains - or _ instead of + and /), and the tool says so and the URL-safe toggle decodes it, or it has lost characters, or contains stray ones. JWT segments in particular are Base64URL, see the Base64 vs Base64URL guide.
Yes: switch to File mode and Base64 → File, paste the Base64 or the data: URL, and the tool detects PNG, JPEG, GIF, WebP or PDF from the first bytes, previews it and offers a download with the right extension. In Text mode, bytes that are not valid UTF-8 are shown as hex instead of garbage.
No, decoding runs in this tab with atob and TextDecoder. Nothing is transmitted.