⌘ K
base64 → text · url-safe · UTF-8 · live

Decode Base64 to text

Convert standard or URL-safe Base64 back to UTF-8 text. Whitespace and missing padding are handled automatically. Everything runs locally in your browser.

Base64 Decoder
Input
20 B
1 lines
Output
13 B
1 lines
Status
ready
live
Ratio
0.65×
out/in
input · base64
output · text
Hello, world!
Quick Start

How to decode Base64: a complete step-by-step guide

Base64 (RFC 4648) packs three bytes into four ASCII characters so binary survives text-only transports — HTTP headers, JSON strings, JWT segments, MIME bodies, data: URIs. This decoder normalizes whitespace, swaps the URL-safe alphabet back to standard, restores any missing padding, then reverses each 4-char group to 3 bytes via atob and interprets them as UTF-8 with TextDecoder.

  1. 01

    Paste Base64 from anywhere

    Drop a Base64 blob from an Authorization: Basic header, a JWT segment, a data: URI body, a MIME attachment, or an API response. Both standard (RFC 4648 § 4, +/=) and URL-safe (§ 5, -_) alphabets are accepted — the decoder detects which one you pasted.

    Line breaks, tabs, and extra spaces are stripped automatically before decoding, so PEM-style 76-column wraps and pretty-printed MIME parts all work without trimming.

    RFC 4648JWT segmentMIMEdata URIPEM wrap
    input · base641 line
    SGVsbG8sIHdvcmxkIQ==
    20 B · 1 linestandard · ready
  2. 02

    Auto-normalize alphabet and padding

    URL-safe input gets remapped: - → +, _ → /. Missing padding is restored by appending = until the length is a multiple of 4 — required because atob rejects unpadded strings.

    This means JWT segments (which always strip padding per RFC 7515 § 2) decode without any manual pre-processing. The same is true for JWT Decoder-style raw segment inspection.

    normalizeRFC 7515paddingalphabet swapatob
    normalize · autoswap + pad
    -_ → +/   ·   pad with '=' to mod-4
    readyRFC 4648 § 5
  3. 03

    Decode bytes as UTF-8

    Each 4-char group converts back to 3 bytes. The resulting Uint8Array is interpreted as UTF-8 via new TextDecoder().decode(bytes), so emoji, accents, and any Unicode round-trip cleanly.

    If the source bytes are actually binary (image, PDF, encrypted blob), the UTF-8 decode will surface replacement characters — for those payloads use Base64 to Image instead.

    UTF-8TextDecoderUint8ArrayUnicoderound-trip
    output · textutf-8
    Hello, world!
    13 B · 13 charsdecoded · ok
  4. 04

    Copy, download, or pipe forward

    One click sends the decoded text to your clipboard; download saves it as .txt with the original encoding preserved. Everything runs locally — open DevTools → Network if you need proof of zero outbound traffic.

    To go the other direction, paste your plain text into the Base64 Encoder. To inspect a full JWT instead of a single segment, the JWT Decoder handles all three parts at once.

    clipboard.txtround-tripprivacy-firstno network
    export · actions3 actions
    ✓ Copied to clipboard
✓ Saved: decoded.txt
✓ 100% client-side
    ready to ship0 outbound
Pro tips

Encoding without surprises

Always UTF-8 first

Use TextEncoder / TextDecoder for bytes ↔ string conversion. btoa alone breaks on non-ASCII.

URL-safe vs standard Base64

Standard uses +, /, =; URL-safe swaps to -, _, no padding. Don’t mix them.

Hashes aren’t passwords

SHA-256 is fast; that’s good for fingerprints, bad for passwords. Use bcrypt / argon2 for credentials.

Watch padding rules

Some decoders are strict about = padding, others auto-pad. If round-trips fail at exactly 1 or 2 bytes, check padding.

Use Web Crypto for keys

Generate cryptographic keys via crypto.subtle, never Math.random. The latter is predictable.

JWT decode ≠ verify

Decoding a JWT just splits and base64-decodes. Verification needs the issuer’s public key / shared secret.

Related toolsBase64 EncoderBase64 to ImageURL DecoderHex to TextHTML DecoderUnicode Converter
Use Cases

When to decode Base64

Inspect tokens, data URIs, MIME parts.

Inspect JWT segments

Decode header and payload of any JSON Web Token. Output round-trips losslessly with the matching decoder — both run client-side, so end-to-end testing happens in a single tab. Encoding flows through TextEncoder for predictable UTF-8 semantics.

RFC-compliant

Data URI extraction

Pull text or JSON out of data: URIs embedded in HTML/CSS. Web Crypto's subtle.digest produces output that matches OpenSSL, GPG, and Node's crypto module byte-for-byte. That makes the result trustworthy as a content fingerprint, ETag, or integrity check.

OpenSSL-matched

Email debugging

Read raw MIME parts encoded as Base64. Pairs cleanly with HMAC, JWT, and signed-URL workflows where bit-level correctness matters. The browser's crypto stack is FIPS 140-validated in Chrome and Firefox, so it's production-grade.

lossless

API responses

APIs sometimes return Base64-encoded blobs — peek at the contents. Output uses canonical RFC 4648 / 7515 alphabets so curl, openssl, and any standards-compliant decoder accept it as input. URL-safe variants drop padding for tokens that travel in query strings.

byte-identical

Config files

Some configs store secrets or binaries as Base64. Heavy hashing runs through useMemo so large inputs don't block typing. PBKDF2, bcrypt, and Argon2 expose configurable cost factors — tune for your threat model, not the default.

spec-grade

Cross-language sanity

Verify your encoder/decoder pair on the wire. Same input plus same options always yields identical bytes. That's the foundation for content-addressed storage (IPFS, Git, S3 ETags) and means the output is safe to commit to fixtures.

production-ready
FAQ

Frequently asked questions

Line breaks and whitespace are stripped automatically before decoding — they don't affect the result.
Yes. The - and _ characters are mapped back to + and /, and missing = padding is restored before decoding.
An error message is shown. Common causes are non-Base64 characters or truncated input.
The decoded bytes are interpreted as UTF-8 so emoji and accented characters come back intact.
No. Decoding runs locally in your browser — your input never leaves your device.
Suggest a tool

Something missing?

Tell us what you need. We ship the top requests every two weeks.

Sent straight to the maintainers · no account needed
47 in queue·8 shipped this month
Request queued. Thanks!