How to use the Base64 decoder
- Paste your string into Base64 to decode. A full data URI is fine.
- Read the Decoded text that appears.
- If the data is an image, check the preview, format, size and dimensions.
- If the data is binary but not an image, read the bytes as hex.
- If you see an error, it names the character and position that is not valid Base64.
What it does and when to use it
Base64 strings turn up all over the place, and they are unreadable until decoded. This decoder is useful when you need to:
- Read the header or payload of a JWT. For a full breakdown of a token, the JWT Debugger does more.
- Check what a Basic Authorization header contains while debugging an API.
- Inspect a Base64 value in a config file, a Kubernetes secret or an API response.
- Look at an inline image from a data URI in some HTML or CSS.
- Find out whether a mystery string is text, an image or other binary data.
To encode text, use the Base64 Encoder. If what you have is full of % signs rather than letters and digits, it is percent-encoded, so use the URL Decoder. For a larger image preview with a download option, try Base64 to Image.
How it works
- Any data URI prefix (such as data:image/png;base64,) and all whitespace are removed.
- URL-safe characters (- and _) are read the same as standard ones (+ and /), and missing padding is allowed.
- Each group of four characters becomes three bytes, following RFC 4648.
- The tool checks the first bytes for the signature of a known image format. If it finds one, it shows the image and reads its dimensions from the file header.
- Otherwise it tries to read the bytes as UTF-8 text. If they are not valid UTF-8, it shows them as hex with a warning, instead of garbled characters.
Everything runs in your browser.
Worked examples
Padding left off. “SGVsbG8sIHdvcmxkIQ” has no = at the end but still decodes to Hello, world!
URL-safe input. “Y2Fmw6kg8J-Riw” contains a -, from the URL-safe alphabet, and decodes to café 👋, with the accent and emoji intact.
A tiny image. A 60-character string starting “R0lGOD” decodes to a 43-byte GIF. The tool shows the preview, Format: GIF and Dimensions: 1 × 1 px. Base64 images often start with recognisable letters: “iVBOR” for PNG, “/9j/” for JPEG and “R0lGOD” for GIF.
A typo. “SGVsbG8*” stops with a message that the “*” at position 8 is not a Base64 character.
Limits and tips
- Text is decoded as UTF-8. Text originally saved in another character set may show odd characters.
- Some strings happen to look like Base64 but are not. If the result is nonsense, the input was probably not Base64 at all.
- Decoding a value does not check that it is genuine. A decoded JWT has not been verified.
Frequently asked questions
Do I need the = padding at the end?
Can it decode URL-safe Base64?
Why is the result shown as hex instead of text?
Can I see an image from a Base64 string?
Is it safe to decode a token or secret here?
How do we know nothing is uploaded? Test it yourself on the privacy proof page.