Can I paste a raw Base64 string without the data: prefix?

Yes. If no data: URI header is present the tool tries to detect the image type from the magic bytes (PNG, JPEG, GIF, WebP, SVG) and renders accordingly.

Is my Base64 string sent anywhere?

No. Decoding runs in your browser with atob and a Blob URL. The string never leaves your device.

Why does decoding fail with valid-looking Base64?

Common culprits are stray whitespace, URL-safe Base64 (with - and _ instead of + and /), or missing padding. Strip whitespace and convert URL-safe characters back before decoding.

base64 · image · auto mime · local

Decode Base64 back to an image

Paste a data: URI or raw Base64 — get a previewable image. Auto-detects PNG, JPEG, GIF, WebP, and SVG from magic bytes. Runs entirely in your browser.

Base64 to Image

Input

—

paste base64

MIME

—

Bytes

—

Status

—

local

input · base64 / data uri

output · preview

Preview will appear here…

Quick Start

How to decode Base64 into an image

If you paste a complete data: URI, the browser renders it directly. Raw Base64 gets the MIME inferred from magic bytes (FFD8 → JPEG, 89PNG → PNG, etc.).

01
Paste Base64
Either a complete data URI or raw Base64 from the wire.
Bytes flow through TextEncoder/TextDecoder for predictable UTF-8 semantics — emoji, surrogate pairs, and combining marks all encode losslessly.
inputUTF-8TextEncoderlosslesslive
input · raw bytesbase64 · UTF-8
```
iVBORw0KGgo…
```
loaded · UTF-8MIME · ready
02
MIME auto-detected
From magic bytes — PNG, JPEG, GIF, WebP, SVG.
Hash and signature operations call crypto.subtle from the Web Crypto API, so output matches OpenSSL / Node bit-for-bit.
sniffWeb Cryptosubtledeterministiclive
mime · optionsimage/png · live
```
89 50 4E 47 → png
```
options applied · livelive
03
Preview renders
If the bytes are valid, the <img> renders on the right.
Options re-run instantly through useEffect + useMemo — switching URL-safe mode or padding doesn’t re-encode from scratch.
rendermemoisedoptionsinstantreactive
out · encodedimage · ready
```
<img src="data:…" />
```
encoded · livelossless
04
Download
Save the decoded image with the detected extension.
Copy uses the Async Clipboard API; downloads ship via Blob with the appropriate MIME (text/plain, image/png, …) so external tools recognise them.
exportclipboardblobMIME-correctclient-side
ok · copiedready · done
```
image.png
```
shipped · ready to shipsuccess

Pro tips

Encoding without surprises

Always UTF-8 first

Use TextEncoder / TextDecoder for bytes ↔ string conversion. btoa alone breaks on non-ASCII.

URL-safe vs standard Base64

Standard uses +, /, =; URL-safe swaps to -, _, no padding. Don’t mix them.

Hashes aren’t passwords

SHA-256 is fast; that’s good for fingerprints, bad for passwords. Use bcrypt / argon2 for credentials.

Watch padding rules

Some decoders are strict about = padding, others auto-pad. If round-trips fail at exactly 1 or 2 bytes, check padding.

Use Web Crypto for keys

Generate cryptographic keys via crypto.subtle, never Math.random. The latter is predictable.

JWT decode ≠ verify

Decoding a JWT just splits and base64-decodes. Verification needs the issuer’s public key / shared secret.

Use Cases

When to decode Base64 images

API debugging, log inspection, archived data.

API debugging

Eyeball Base64 image fields returned by a JSON API. Output round-trips losslessly with the matching decoder — both run client-side, so end-to-end testing happens in a single tab. Encoding flows through TextEncoder for predictable UTF-8 semantics.

RFC-compliant

Log inspection

Render Base64 attachments captured in app logs. Web Crypto's subtle.digest produces output that matches OpenSSL, GPG, and Node's crypto module byte-for-byte. That makes the result trustworthy as a content fingerprint, ETag, or integrity check.

OpenSSL-matched

Email source viewing

Decode MIME-encoded inline images from raw email. Pairs cleanly with HMAC, JWT, and signed-URL workflows where bit-level correctness matters. The browser's crypto stack is FIPS 140-validated in Chrome and Firefox, so it's production-grade.

lossless

Database extraction

Pull images stored as TEXT in a DB column. Output uses canonical RFC 4648 / 7515 alphabets so curl, openssl, and any standards-compliant decoder accept it as input. URL-safe variants drop padding for tokens that travel in query strings.

byte-identical

Backup recovery

Recover images from old JSON / YAML dumps. Heavy hashing runs through useMemo so large inputs don't block typing. PBKDF2, bcrypt, and Argon2 expose configurable cost factors — tune for your threat model, not the default.

spec-grade

Penetration testing

Inspect Base64-encoded payloads from captures. Same input plus same options always yields identical bytes. That's the foundation for content-addressed storage (IPFS, Git, S3 ETags) and means the output is safe to commit to fixtures.

production-ready

FAQ

Frequently asked questions

Why isn't the image rendering?

Common causes: extra characters (spaces, newlines, quotes), wrong padding, or non-image bytes. Check the first few bytes match a known image format.

How is MIME guessed?

From magic bytes — 89 50 4E 47 → PNG, FF D8 → JPEG, 47 49 46 38 → GIF, RIFF…WEBP → WebP, <svg → SVG.

Can I decode SVG?

Yes — both Base64-encoded SVG and raw text SVG (the latter detected by the leading <svg).

Are PDFs supported?

No, this tool is image-only. For PDFs paste the data URI directly into the browser address bar.

Is anything sent to a server?

No. The Base64 is decoded in your browser via atob — it runs locally and your data never leaves the device.

Suggest a tool

Something missing?

Tell us what you need. We ship the top requests every two weeks.

47 in queue·8 shipped this month

Request queued. Thanks!