When to use this
Decode when you meet an opaque blob: a Basic auth header, a data: URL, an encoded config value, an email attachment segment.
This page is a focused view of theBase64 Encode / Decode, which has the full set of options.
Base64 decode
Decoding reverses the 4-characters-to-3-bytes mapping of RFC 4648: whitespace and line breaks are stripped first (MIME wraps encoded blobs at 76 characters), the Base64 is converted back to bytes, and the bytes are decoded as UTF-8 text. A valid Base64 string's length is always a multiple of 4 after padding — length mod 4 equal to 1 is impossible and means characters were lost.
One structural fact solves most decode failures: standard Base64 uses “+” and “/” at alphabet positions 62 and 63, while Base64URL uses “-” and “_” and usually drops the “=” padding. A string containing “-” or “_” — every JWT segment, for example — is Base64URL and fails strict standard decoders until the two characters are swapped back and padding restored.
When it goes wrong
“That string is not valid Base64.” means one of three things, in order of likelihood: the string is Base64URL (contains “-” or “_”), characters were truncated (length mod 4 is 1), or stray non-alphabet characters rode along in the paste. If decoding succeeds but shows garbage, the original bytes were not text — a PNG or gzip payload decodes fine as bytes but is not valid UTF-8 prose.
Next steps
Frequently asked questions
Why does decoding fail with “not valid Base64”?
Usually the string is actually Base64URL (contains - or _ instead of + and /), has lost its padding, or contains stray characters. JWT segments in particular are Base64URL — see the Base64 vs Base64URL guide.
Can this decode files, like images?
This tool decodes to text. A decoded image would render as unreadable characters, because PNG or JPEG bytes are not valid UTF-8 text.
Is the decoded content visible to anyone else?
No — decoding runs in this tab with atob and TextDecoder. Nothing is transmitted.