Base64 Decode

Base64 Input
0 characters

Free online Base64 decoder to convert Base64 strings back to readable text or binary. Supports UTF-8 / ASCII / ISO-8859-1, URL-Safe variant, and auto-padding fixes. Perfect for API debugging and log analysis.

Related

What is Base64 Decoding?

Base64 decoding is the reverse of Base64 encoding: it takes a Base64 string made up of A-Z, a-z, 0-9, +, /, and =, and converts it back to the original binary or text. The algorithm is standardised by **RFC 4648 §4** (the current canonical standard, which supersedes the older RFC 2045 and RFC 3548) and is the inverse of the encode step — every 4 Base64 characters map back to 3 bytes (24 bits) of original data.

In practice, Base64 decoding shows up everywhere in modern web development: the header and payload segments of JWT tokens are Base64URL-encoded JSON; HTTP Basic Authentication sends `Authorization: Basic <base64(username:password)>`; Data URIs embed small images as `data:image/png;base64,...`; and many APIs wrap binary attachments in Base64 so they survive JSON serialisation.

**Charset handling** is the most common pitfall. The browser's built-in `atob` and `btoa` APIs only operate on Latin-1 (ISO-8859-1), where every character is exactly 1 byte. CJK characters, emoji, and accented letters take 2–4 bytes in UTF-8, so passing them directly to `atob` throws an `InvalidCharacterError`. The tool wraps `atob` with `decodeURIComponent(escape(...))` (or the modern `TextDecoder` API) so multibyte text decodes correctly.

**URL-Safe Base64** (RFC 4648 §5, also called Base64URL) replaces the standard + and / characters with - and _, and usually drops the = padding. JWT, OAuth PKCE, and many URL parameters rely on this variant. To decode it, you must first map -_ → +/ and re-add padding until the length is a multiple of 4 — the tool does this automatically.

All decoding happens **entirely in your browser**. The Base64 string is processed by client-side JavaScript and never sent over the network. Open the Network tab in your browser's developer tools while decoding sensitive data to confirm there are zero outbound requests.

Use Cases

  • Decode Base64-encoded API responses and JWT tokens to view the original JSON or text content
  • Restore readable text from Base64 fields found in server logs, error stacks, or database exports
  • Recover configuration values and credentials stored in Base64 format during system migrations
  • Troubleshoot and fix decoding errors caused by missing padding, URL-Safe characters, or line breaks
  • Decode Data URIs to inspect or save embedded images, fonts, or CSS assets
  • Decode HTTP Basic Authentication header values (Basic dXNlcjpwYXNz) to inspect the username:password pair

How to Use

  1. Paste the Base64 string you want to decode into the input box
  2. Pick the charset — UTF-8 (default), ASCII, or ISO-8859-1 — that matches the original encoding
  3. The tool auto-detects the variant (Standard, URL-Safe, or MIME) and decodes the string in real time
  4. Copy the decoded result to your clipboard, or download it as a text / binary file

Features

  • Live decode with debounce: paste a Base64 string and the result appears in 300ms without manually clicking a button
  • Multi-charset support: UTF-8 (for CJK / emoji / accented text), ASCII, and ISO-8859-1 cover the vast majority of real-world payloads
  • URL-Safe Base64 compatible: automatically normalises - and _ back to + and /, and re-adds missing = padding
  • Detailed error localisation: when decoding fails, the tool reports the exact position of the bad character so you can fix the source quickly
  • Auto-detect format: instantly recognises MIME line breaks, URL-Safe variants, and missing padding without manual toggling
  • Binary file decode: switch the output to binary to download decoded images, PDFs, or other file attachments directly
  • One-click copy and download: copy the decoded text to the clipboard, or download it as a .txt / .bin file

Code Examples

Base64 Decoding in JavaScript (UTF-8 Support)

// Standard decode (supports UTF-8)
function b64Decode(str) {
  return decodeURIComponent(escape(atob(str)));
}

// URL-Safe decode (for JWT / OAuth)
function b64UrlDecode(str) {
  // Replace URL-safe chars back to standard
  str = str.replace(/-/g, '+').replace(/_/g, '/');
  // Add missing padding
  while (str.length % 4) str += '=';
  return decodeURIComponent(escape(atob(str)));
}

console.log(b64Decode('SGVsbG8g5LiW55WM'));   // Hello 世界
console.log(b64UrlDecode('SGVsbG8g5LiW55WM')); // Hello 世界

// Decode a JWT payload (Base64URL)
function decodeJwtPayload(token) {
  const payload = token.split('.')[1];
  return JSON.parse(b64UrlDecode(payload));
}

Base64 Decoding in Python

import base64

# Standard decode (UTF-8)
decoded = base64.b64decode('SGVsbG8g5LiW55WM').decode('utf-8')
print(decoded)  # Hello 世界

# Standard decode with auto-padding
def b64_decode_auto(s: str) -> bytes:
    s = s.strip()
    # Add missing padding for URL-Safe variants
    s += '=' * (-len(s) % 4)
    return base64.b64decode(s)

print(b64_decode_auto('SGVsbG8g5LiW55WM').decode('utf-8'))  # Hello 世界

# URL-Safe decode (for JWT / OAuth)
url_decoded = base64.urlsafe_b64decode('SGVsbG8g5LiW55WM' + '=' * (-len('SGVsbG8g5LiW55WM') % 4))
print(url_decoded.decode('utf-8'))  # Hello 世界

# Decode a JWT payload
import json
def decode_jwt_payload(token: str) -> dict:
    payload = token.split('.')[1]
    payload += '=' * (-len(payload) % 4)
    return json.loads(base64.urlsafe_b64decode(payload))

print(decode_jwt_payload('eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjM0In0.abc'))

Base64 Decoding in Java

import java.nio.charset.StandardCharsets;
import java.util.Base64;

public class Base64DecodeExample {
    public static void main(String[] args) {
        String encoded = "SGVsbG8g5LiW55WM";

        // Standard decode
        String decoded = new String(
            Base64.getDecoder().decode(encoded), StandardCharsets.UTF_8);
        System.out.println(decoded); // Hello 世界

        // URL-Safe decode (auto handles missing padding)
        String urlSafe = new String(
            Base64.getUrlDecoder().decode(encoded), StandardCharsets.UTF_8);
        System.out.println(urlSafe);

        // MIME decode (handles 76-char line wrapping)
        String mimeEncoded = "SGVsbG8g5LiW55WM\n";
        String mimeDecoded = new String(
            Base64.getMimeDecoder().decode(mimeEncoded), StandardCharsets.UTF_8);
        System.out.println(mimeDecoded);
    }
}

FAQ

How do I decode a Base64 string back to text?

Paste your Base64 content into the input box. The decoder automatically detects the variant (Standard, URL-Safe, or MIME) and converts the string back to the original text or binary data in real time, so you can instantly view API responses, log fields, or configuration values.

Why is my Base64 decoding failing with an 'invalid character' error?

Common causes include: missing padding characters (=), stray whitespace / newlines / quotes inside the string, or the use of URL-Safe characters (- and _ instead of + and /). The decoder automatically strips whitespace and re-adds padding, and you can switch to URL-Safe mode when the input uses - or _.

The decoded output is garbled or full of question marks — what went wrong?

The charset is probably wrong. If the original data was CJK, emoji, or accented text, switch the charset to UTF-8. If it was binary data such as an image or PDF, switch to ISO-8859-1 (Latin-1) or download the raw bytes instead of treating them as text.

Can this tool decode URL-Safe Base64 strings (and JWT payloads)?

Yes. Many web APIs, JWT tokens, and OAuth values use URL-Safe Base64 (Base64URL). The tool detects and converts - and _ back to + and /, and re-adds the missing padding automatically — so you can paste a JWT payload directly and read the claims as JSON.

Is it safe to decode sensitive API keys or tokens here?

Absolutely. GeekFormat's Base64 decoder runs entirely on the client-side (in your browser). Your sensitive data, API keys, and tokens are processed locally and are never transmitted to or stored on any external server. You can verify this by opening the Network tab in your browser's developer tools.

What is Base64 padding and why does it matter when decoding?

Base64 output length must always be a multiple of 4. When the input length is not a multiple of 3 bytes, the output is padded with = characters. Standard Base64 always uses padding, while Base64URL (used by JWT) usually omits it. The tool auto-fills the missing padding so the decode succeeds.

Can I decode Base64 to binary (images, PDFs, files) and download it?

Yes. Switch the output mode from text to binary / file download, and the tool will save the decoded bytes as a file. This is useful for restoring Base64-embedded images, certificates, attachments, and Data URI payloads.

What's the difference between atob and a full Base64 decoder?

atob is a browser API that only supports the Latin-1 (ISO-8859-1) charset. Chinese, Japanese, emoji, and other multibyte characters occupy more than 1 byte, so atob throws an InvalidCharacterError on them directly. The tool wraps atob with UTF-8 transcoding logic so multibyte content decodes correctly.

How do I decode a JWT header or payload?

JWT uses the Base64URL variant. Copy the first segment (header) or the second segment (payload) and paste it into the decoder. The third segment is a cryptographic signature — decoding it just gives you raw bytes, and you should verify it with the JWT tool rather than trying to read it as text.

Is Base64 decoding the same as decryption?

No. Base64 is a reversible transformation that anyone can decode back to the original — it is not encryption and offers no security. If you need confidentiality for passwords, tokens, or other secrets, use a real encryption scheme such as AES instead.

Glossary

Base64
A binary-to-text encoding scheme that uses 64 printable ASCII characters (A-Z, a-z, 0-9, +, /) plus the = padding character. Defined in RFC 4648, it lets binary data travel safely through text-only systems such as JSON, XML, and email.Base64 Encoder
RFC 4648
The current IETF standard for Base16, Base32, and Base64 encodings. Section 4 defines Standard Base64, and Section 5 defines the URL-Safe variant. It supersedes the older RFC 2045 and RFC 3548.URL-Safe Base64 Tool
Padding
The = character used at the end of a Base64 string to make the output length a multiple of 4. Standard Base64 always pads; Base64URL typically omits padding. The decoder auto-fills missing = when needed.Base64 Padding Tool
atob
The browser's native Base64 decode API (ASCII-to-binary). Returns a binary string where each character holds one byte. Only supports Latin-1 — multibyte UTF-8 text must be transcoded via decodeURIComponent / TextDecoder first.MDN atob()
btoa
The browser's native Base64 encode API (binary-to-ASCII), the counterpart to atob. Same Latin-1 limitation: encoding UTF-8 text requires pre-encoding with encodeURIComponent / TextEncoder.MDN btoa()
MIME
Multipurpose Internet Mail Extensions — the standard (RFC 2045) that originally introduced Base64 as a content transfer encoding for email. MIME Base64 wraps output to 76 characters per line (CRLF).MIME Base64 Tool
Base64URL (URL-Safe Base64)
The URL-friendly Base64 variant defined in RFC 4648 §5. Replaces + with - and / with _, and usually drops = padding. Used in JWT, OAuth PKCE, URL query parameters, and filenames.JWT Tool
InvalidCharacterError
The error thrown when a Base64 string contains characters outside the allowed alphabet (for example spaces, newlines, quotes, or -/_ in Standard mode). The decoder strips whitespace and offers URL-Safe mode to handle these cases automatically.URL-Safe Base64 Tool

Base64 Variant Comparison

FeatureStandardURL-SafeMIME
Special chars+ /- _+ /
Padding (=)UsedOmittedUsed
Line breaksNoneNoneEvery 76 chars
StandardRFC 4648 §4RFC 4648 §5RFC 2045
Decode notesReplace -_ → +/ before decodingAdd = padding to a multiple of 4Strip CRLF every 76 chars

Common Base64 Decode Errors

ErrorLikely CauseHow to Fix
InvalidCharacterErrorString contains characters outside the Base64 alphabet (spaces, newlines, quotes, etc.)Strip whitespace and quotes, or paste the raw payload directly
Length % 4 != 0Padding characters (=) are missing, or extra padding was addedAuto-correct by adding = until length is a multiple of 4
Garbled text (mojibake)Wrong charset chosen — original was UTF-8 but decoded as ISO-8859-1, or vice versaSwitch the charset to UTF-8 for CJK / emoji / accented text
Empty resultInput is empty, or only contains whitespace / line breaksMake sure the Base64 string itself was copied
JWT decode failsPasted the full token including the signature, or did not switch to URL-Safe modePaste only the header or payload segment, and enable URL-Safe decoding

Authoritative References