Base64 Decoder

What is a Base64 decoder

A Base64 decoder reverses the encoding: it reads the 64-character alphabet back into the original bytes, then shows you those bytes as text. If the bytes were text to begin with, a JSON payload, a JWT claim set, a password in an Authorization header, a value out of a Kubernetes secret, you get the original string back exactly, accents and emoji included, because the bytes are read as UTF-8.

If the bytes were never text, you will see a warning instead of nonsense. A Base64 string holding a PNG, a PDF or a zip archive decodes perfectly well, but there is no sensible way to display the result in a text box, so the tool tells you the input was valid Base64 carrying binary data rather than pretending otherwise.

Both alphabets, no switch needed

There are two Base64 alphabets in common use. Standard Base64 uses + and / for its last two characters and pads the end with = to a multiple of four. URL-safe Base64, which RFC 4648 calls base64url, uses - and _ instead so the string can sit in a URL path or query without escaping, and usually drops the padding.

You do not have to know which one you have. This decoder accepts both, treats - and _ as + and /, and restores missing padding itself, so a JWT segment copied straight out of a browser's network tab decodes without being tidied up first. Whitespace and line breaks are ignored too, which matters when the string was wrapped at 76 characters by an email client or a PEM file.

Why a decode fails

• A character outside the alphabet the usual cause is a truncated copy that caught a quote, a comma or a closing brace from the surrounding JSON. Check the ends of the string first.
• A length that cannot work Base64 encodes three bytes at a time into four characters, so a string of length 4n+1 cannot be valid, however it was produced.
• A URL that was escaped twice if you see %2B or %3D in the string, you are looking at percent-encoded Base64. Decode the URL encoding first, then the Base64.
• It was never Base64 hexadecimal, a UUID and a hash all look like opaque strings and are not Base64. A hex digest uses only 0–9 and a–f; Base64 mixes upper and lower case.

Decoding a JWT, carefully

A JSON Web Token is three base64url segments separated by dots: header, payload, signature. Paste the middle segment here and you get the claims as JSON, the issuer, the subject, the expiry, which is the fastest way to answer "is this token expired?" or "which account did the gateway think this was?".

Two cautions. The signature is not verifiable by decoding; checking that the token is genuine needs the signing key, which belongs on a server, not in a browser tab. And a token you can decode is a token anyone who intercepts it can decode: if what you just read in the payload would embarrass you in a log file, it should not be in the payload. Decoding here is safe in the one way that matters: the token stays on your machine, because the decode runs in the page and nothing is uploaded.