Decode Base64
Paste Base64 and get back what it was — text, an image, a PDF, anything. Broken padding, line wrapping and URL-safe variants are all repaired automatically. Nothing is stored.
- Never stored
- No queue, no waiting
- No signup, no watermark
Paste Base64 and whatever it decodes to appears here.
How it works
Paste the Base64
Wrapped, unpadded, URL-safe or inside a PEM block — all are accepted and each repair is reported.
See what it was
Text is shown as text. Binary is identified by its own bytes — PNG, PDF, ZIP — and offered as a download with the right extension.
Copy or save
Copy the text, or download the recovered file.
What comes back out
What Base64 holds is bytes, and the page shows them as text only if they decode as valid UTF-8 with nothing substituted. The decoder runs in strict mode, so a byte sequence that is not UTF-8 produces no text at all rather than a screenful of replacement characters — which is deliberate, because a wall of question-mark diamonds looks like a result and is not one. When there is no text you get the bytes as a download instead, with the extension read from the first few bytes themselves: PNG, JPEG, GIF, WebP, PDF, gzip, ZIP, RAR, 7z and the three web font formats are recognised, and a ZIP is opened far enough to tell a .docx, .xlsx, .pptx or .epub from a plain archive. Anything unrecognised that is not text comes back as .bin.
The repairs are worth understanding, because one of them is a guess rather than a rule. Removing line breaks, stripping PEM wrapper lines and adding missing padding are all unambiguous — there is exactly one thing the string could have been. A space is not. It may be incidental whitespace, or it may be a "+" that a URL turned into a space somewhere in transit. Both readings are tried, "+" first, and the first that decodes is the one you are shown; when a string decodes either way nothing can tell you which was meant, so look at the result before trusting it. A string mixing the two alphabets — a "+" or "/" alongside a "-" or "_" — is not repaired at all, because there is no reading of it that is right.
When you want something else
Your own machine already does this. base64 -d on macOS and Linux, certutil -decode on Windows, openssl base64 -d anywhere, or one line of Python — all of them take a file rather than a clipboard, and none of them involve a web page. For a credential that is live right now that is simply the better habit, whatever any site promises, this one included. The claim on this page is true and the way to establish it is pulling the plug after the page loads and watching the decoder carry on working — not the sentence itself. And if you have already pasted a working secret somewhere you cannot audit, rotate it. Rotating costs a minute; reasoning about whether it was safe does not end.
The other limit is size. The string is held as text and the result again as bytes, so a data URI for a large image occupies the tab several times over, and something in the hundreds of megabytes will fail here where a command-line decoder streams it without noticing. Decoding a column of a database dump, or every data URI out of a stylesheet, is the same answer for a different reason: that is a script, not a paste.
Frequently asked questions
Is my Base64 stored anywhere?
No. Nothing is stored, nothing is logged, and no server ever sees it — and it keeps working with the network disconnected. For these tools in particular that is not a nicety. What people paste into online encoders and decoders is routinely live: session tokens, API keys, Authorization headers, customer records. Pasting one of those into a page that sends it somewhere is a disclosure, whatever the site promises about deletion.
It says invalid Base64, but I copied it correctly
Four things commonly break a copied string, and all four are repaired here automatically rather than refused. Line breaks from email headers, PEM blocks or MIME wrapping are removed. Missing = padding is added. The URL-safe alphabet (- and _ instead of + and /) is detected and translated. And spaces are tried BOTH ways — as incidental whitespace, and as + characters that a URL turned into spaces, which is what happens whenever Base64 travels through a query string. Each repair is named in the result, so you can see what your string actually was. If it still fails, a character was genuinely lost in copying, and the page says which.
Can it decode a JWT?
It will decode each part, but the JWT Decoder is the better page for that — it splits the three sections, formats the JSON, turns the timestamps into real dates and tells you whether the token has expired. Do not paste a live session token into a general decoder anywhere; on this site it is never stored either way, but that is not true of most.
What happens with an image or a PDF?
It is recognised and offered as a download. The file type is identified from the decoded bytes themselves rather than from anything you tell us — a PNG signature, a PDF header, a ZIP marker — so the download gets the right extension even when the original name is long gone. Images are previewed in the page.
What does "read as Base64URL" mean in the result?
That your string used the URL-safe alphabet, where - and _ stand in for + and /. It is the variant used by JWTs, OAuth and anything carried in a URL. The two alphabets decode to different bytes, so getting this wrong produces silent corruption rather than an error — it is detected and reported rather than assumed.
Can I decode something someone sent me safely?
Decoding itself is safe — nothing is executed, and nothing is stored. But be careful with what comes out. Base64 is a common way to hide a malicious script or executable from a mail filter, so treat a decoded file from an unexpected source exactly as you would treat an unexpected attachment.
Is there a size limit?
Available memory, rather than a fixed size cap. Large strings decode fine.
Good to know: What comes out is bytes, and bytes do not say what they are. The file type is guessed from magic numbers at the start of the data, which is reliable for common formats and silent about the rest. Base64 that was never valid decodes to nonsense rather than an error, so check the result looks right.
Put this tool on your website
Free for any blog, class page or help article. Paste one snippet and your visitors can use it right on your page.