Base64 Decode

What the Base64 decoder does

You have a block of Base64, that wall of letters and digits, and you want to know what it really says. Paste it in, press Convert, and you get the original text back. This is the reverse of Base64 encoding, the trip home.

It is forgiving about the input, too. It strips out line breaks if your Base64 came wrapped across several lines, and it quietly fixes missing padding, so you do not have to tidy the string up by hand before it will work.

How to use it

1. Paste your Base64. Drop it into the box, or upload a plain text file that holds it.
2. Character encoding, if needed. The default UTF-8 is right almost every time. The selector is there for the rare case where the original text used a different encoding.
3. Press Convert. The decoded text appears below, ready to Copy or Download.

Clear empties the boxes when you want to start fresh.

How decoding works, step by step

Decoding just runs the encoding steps backwards. Base64 packs three bytes of data into four characters, so to decode, the tool reads your string four characters at a time and rebuilds the three bytes they stand for.

Each character is looked up in the 64-character alphabet to get its value from 0 to 63, which is a 6-bit number. Four of those 6-bit numbers laid end to end give 24 bits, and 24 bits is exactly three 8-bit bytes. So every four characters in become three bytes out.

Take "TWFu". The four characters are values 19, 22, 5, and 46. Write those as 6-bit groups and join them, then re-slice into bytes of 8, and you get 77, 97, 110, which are the letters M, a, n. So "TWFu" decodes back to "Man". A string ending in = signs just means the last group was padded during encoding, and the decoder drops that padding as it rebuilds the bytes, so "SGk=" comes back as "Hi".

The library, and why your emoji survive

The decoding is done by base64-js, a small, dependency-free and very widely used JavaScript library. Its job here is to turn the Base64 string into the raw bytes it represents.

Then those bytes go through the browser's TextDecoder, which reads them back as UTF-8 text. That second step is the one that matters for real-world data. Because the bytes are interpreted as UTF-8, anything that was encoded correctly comes back correctly, accented characters, emoji, Nepali, Japanese, the lot. A naive decoder that assumes plain ASCII would turn those into garbage, so reading the bytes as UTF-8 is what keeps the round trip honest.

When a decode fails, and how to tell why

If the tool throws an error instead of giving you text, the string almost always is not clean Base64. A few things to check, in the order they usually go wrong:

• It might be Base64url, not Base64. If you see - or _ characters in the string, it is the URL-safe variant, which uses a slightly different alphabet. Decode it with the Base64url tool instead.
• There may be stray characters. Real Base64 only uses A to Z, a to z, 0 to 9, + and /, plus = at the end. A stray quote mark, space in the middle, or copy-paste artifact will trip it up.
• It might not be Base64 at all. Plenty of strings look like Base64 without being it. If it was never encoded, there is nothing to decode.

Missing padding is the one thing you do not need to worry about here, since the tool adds it back for you.

What people use it for

Decoding is mostly about reading something that was packed away as Base64. Common cases: peeking inside a token or a config value to see what it actually holds, pulling the text back out of a data URI, reading an email part that was encoded for transit, or debugging an API that hands you Base64 and leaves you to work out what is in it. If the decoded text turns out to be JSON or XML, the Base64 to JSON and Base64 to XML tools are pointed straight at those cases.

A word on what decoding proves

Here is the thing decoding makes obvious. Anyone can do it, instantly, with no key and no password, exactly as you just did. That means Base64 never hid anything in the first place. It is a way to package data for travel, not a way to lock it. So if you ever find a password or a secret sitting in Base64 somewhere, treat it as if it were written in plain text, because to anyone with a decoder, it is.

Questions people ask

How do I decode a Base64 string?

Paste it into the box and press Convert. The tool reads the string four characters at a time, rebuilds the original bytes, and shows you the text. Line breaks and missing padding are handled for you.

Why do I get an error when I try to decode?

Usually the string is not clean Base64. Check for - or _ characters, which mean it is the URL-safe variant for the Base64url tool, and for stray spaces or characters that are not part of the Base64 alphabet.

Will it handle emoji and other languages?

Yes. The decoded bytes are read as UTF-8, so emoji, accents, and non-English scripts come back intact rather than as broken characters.

If I can decode it so easily, was it even protected?

No. Base64 is an encoding, not encryption. There is no key and anyone can reverse it, so it offers no secrecy at all. Treat anything you find in Base64 as readable by everyone.

References

1. Josefsson, S. (2006). RFC 4648: The Base16, Base32, and Base64 Data Encodings. Internet Engineering Task Force (IETF). https://www.rfc-editor.org/rfc/rfc4648
2. base64-js, a Base64 encoding and decoding library for JavaScript (npm package). https://www.npmjs.com/package/base64-js
3. MDN Web Docs, Base64 (glossary entry and encoding overview). https://developer.mozilla.org/en-US/docs/Glossary/Base64