Decode and inspect

Base64 to text, hex, image, or file

Paste an encoded value, load a Base64 text file, choose the alphabet plus independent whitespace and padding policies, then copy or download the exact decoded bytes.

Loading the Base64 decoder…

Enable JavaScript to decode, validate, preview, copy, and download Base64 data. The explanatory guide below remains available without JavaScript.

A dependable three-step workflow

How to decode Base64 online

A useful decoder does more than call a permissive browser function. It preserves bytes, explains normalization, and lets you distinguish readable text from arbitrary binary content.

  1. 1

    Paste or load the encoded input

    Paste a Base64 string, a Base64URL token segment, or a complete data: URL. For a large encoded payload, load the local text file so you do not have to pass it through another application first.

  2. 2

    Choose alphabet and protocol rules

    Auto-detection separates standard +// from URL-safe -/_ when distinguishing symbols exist. Set whitespace and padding independently: wrapped MIME can allow whitespace, while JWS requires unpadded Base64URL with no whitespace.

  3. 3

    Interpret the decoded bytes

    Read valid UTF-8 as text, switch to hex for binary data, preview a raster image with a recognized signature, or download the byte sequence. A successful decode does not prove that the content is safe or trustworthy.

Encoding is a byte representation

What a Base64 decoder actually returns

Base64 represents binary data with a restricted set of printable ASCII characters. A decoder reverses that representation: each group of four encoded characters normally becomes three original bytes. It does not inherently return words, JSON, an image, or a document. Those meanings come from interpreting the resulting bytes with the correct character encoding or file format.

This distinction explains why some valid Base64 turns into readable text while other valid input looks like noise. If the bytes form well-formed UTF-8, LiveParse can show their Unicode text. If they do not, the honest representation is hexadecimal or a downloaded binary file. Replacing invalid byte sequences with the Unicode replacement character would hide data loss, so this decoder labels such content as binary instead of pretending it is text.

Base64 also contains no filename, content type, compression flag, checksum, or security guarantee. A surrounding protocol may provide those facts. A Data URL, for example, can carry a media-type label, but that label is metadata supplied by the sender rather than proof of the bytes’ true format. Use file signatures, protocol documentation, and application-level integrity checks when the origin is untrusted.

Input
Printable Base64 or Base64URL characters, optional padding, or a Data URL.
Output
The original sequence of bytes, without an automatic promise that it is text.
Text view
Available when the entire decoded byte sequence is valid UTF-8.
Hex view
An unambiguous byte-by-byte representation for binary or forensic inspection.

Two alphabets, the same 6-bit idea

Choose the correct alphabet before decoding

RFC 4648 defines both the familiar standard alphabet and a URL- and filename-safe alphabet. Their bit packing is the same, but two characters differ and padding conventions often differ in real protocols.

PropertyStandard Base64Base64URL
Characters 62 and 63+ and /- and _, avoiding reserved or awkward URL and filename characters.
Padding= commonly retainedOften omitted by JWT and other compact formats, although the underlying length rules still apply.
Typical contextsMIME, APIs, files, Data URLsURL components, cookies, JWT segments, filenames, and compact identifiers.
Interchange warningNot automatically URL-safeDo not merely delete punctuation; translate the alphabet and follow the target protocol’s padding rule.

Validity is more than a character regex

Padding and strict canonical Base64 validation

A Base64 string is built from 24-bit groups. Three source bytes become four six-bit symbols. When the final group contains only one or two source bytes, standard Base64 uses one or two = characters to mark the shortened ending. An encoded data length can therefore end with no padding, one =, or two ==, but padding is never allowed in the middle.

Strict validation checks the chosen alphabet, total length, padding position, and the unused low-order bits in the final symbol. Those unused bits are called pad bits and must be zero in canonical RFC 4648 output. Multiple non-canonical strings can otherwise decode to the same bytes, which is undesirable for signatures, cache keys, comparisons, deduplication, and systems that require one stable textual representation.

LiveParse exposes whitespace and padding as separate policies instead of hiding them behind one “strict” switch. You can reject whitespace while forbidding padding for JWS, reject whitespace while requiring standard padding, or ignore ASCII whitespace while allowing omitted padding for a documented wrapped format. Every combination still rejects invalid characters, mixed standard and URL-safe alphabets, impossible lengths, misplaced padding, and non-zero canonical pad bits.

When verifying a signature or reproducing a protocol message, validate the original text under that protocol’s exact rules before normalizing. Decoding and re-encoding may create a canonical string, but it cannot prove the sender originally supplied that form. The diagnostic output shows the detected alphabet and whether whitespace or padding was normalized so the transformation remains visible.

Whitespace
Reject it for compact protocols, or ignore only ASCII whitespace when the format permits wrapping.
Padding
Require, allow missing, or forbid trailing equals signs according to the protocol.
Canonical
One stable RFC representation with zero unused pad bits.
Round trip
Decode and re-encode to compare bytes and obtain a normalized representation.

Bytes first, characters second

UTF-8 text, Unicode, and binary Base64

Decode text with the right character set

Base64 has no character-set field. Modern JSON, web, and API text is usually UTF-8, so this tool validates the complete decoded sequence as UTF-8 before displaying it. Older content may use Latin-1, Windows-1252, UTF-16, or another encoding and will need a decoder that explicitly supports that charset.

Keep Unicode byte-exact

Emoji, Korean, accented letters, and other non-ASCII characters use multiple UTF-8 bytes. Decoding produces those original bytes first; only then does UTF-8 interpretation reconstruct code points. Byte length and visible character count are therefore different measurements.

Inspect binary as hex

Images, archives, fonts, PDFs, protobuf messages, and encrypted ciphertext are not text. Hex output preserves byte identity without inserting replacement characters or control codes into the page. Download the result when another application needs the original file.

Do not infer trust from readable output

Readable JSON or HTML can still be malicious, misleading, or incomplete. Base64 validation checks the encoding layer only. Validate the decoded format, authenticate its source, and apply the same content-security rules you would use for any untrusted file or string.

Payload containers

Decode Base64 files and Data URLs without unsafe execution

A plain .b64, .base64, or text file usually contains only encoded characters, sometimes wrapped onto several lines. Load it into the decoder, choose the correct alphabet, and inspect the reported normalization. The tool reads the selected file in the current browser tab and can download the recovered bytes. The 10 MB input limit is a browser-safety boundary designed to reduce long freezes and memory spikes, not a limit in the Base64 specification.

A Data URL combines a header and payload, such as data:image/png;base64,iVBORw0…. The header may declare a media type and parameters; the comma separates it from the encoded bytes. LiveParse parses the Base64 form and reports its label, but does not assume the label is true. For images, preview eligibility is based on recognized raster signatures in the decoded bytes.

Previewing untrusted active content inside a page creates unnecessary risk. This decoder never renders decoded HTML or SVG and does not execute scripts, open documents, or hand arbitrary bytes to a plugin. It previews only recognized PNG, JPEG, GIF, and WebP raster data. Everything else remains text, hex, or a download that you can examine with an appropriate isolated tool.

Large decoded results are shortened in the on-page preview so the interface remains responsive. Copy and download actions operate on the complete result. If the data is sensitive, remember that clipboard managers, downloaded files, browser extensions, backups, and operating-system history exist outside the converter’s control.

Data URL
A data: header, optional media type, ;base64 marker, comma, and payload.
Magic bytes
Format signatures used to restrict previews to a limited set of raster image types.
No active view
Decoded HTML and SVG are never embedded or executed by the preview.
Full result
Copy and download retain all bytes even when the visible preview is shortened.

Local conversion, honest boundaries

Private Base64 decoding in the browser

The decode operation runs in JavaScript in the current browser tab. Text and selected file contents are not posted to a Base64 conversion service. This is especially useful for inspecting development payloads, internal identifiers, log excerpts, and sample files that should not be copied into a third-party API.

“Local processing” does not mean the device itself is a secure enclave. The browser still loaded this page and its assets, and software on the device may observe screen, clipboard, memory, or files according to its permissions. Avoid decoding production secrets on an untrusted or shared computer, clear the input when finished, and review the LiveParse privacy page for the site’s data-handling details.

Base64 is reversible encoding, not encryption, hashing, redaction, or access control. Anyone who receives a Base64 value can normally decode it without a key. Encoding a password, API key, personal record, or session token does not protect it. Use authenticated encryption and an appropriate key-management design when confidentiality and tamper detection matter.

Local tool
The conversion input is not sent to a server-side decoding API.
Reversible
No password or secret key is needed to recover ordinary Base64 bytes.
Not integrity
Successful decoding does not show who created the content or whether it changed.
Device risk
Extensions, clipboard tools, downloads, and other local software remain separate concerns.

Diagnose instead of guessing

Common Base64 decoding errors

SymptomLikely causeWhat to check
Invalid characterUnexpected punctuationConfirm whether the input is standard Base64 or Base64URL. Remove only documented surrounding syntax; never delete arbitrary characters until it decodes.
Impossible lengthRemainder of one symbolThe value may be truncated. Missing padding can repair lengths with remainders of two or three, but no Base64 byte sequence is represented by one final symbol.
Mixed alphabet+ / together with - _Identify the producing protocol. Mixed variants usually indicate concatenation, accidental URL transformation, or corrupted copying.
Unreadable textValid bytes, invalid UTF-8Use hex or download the file. It may be binary, compressed, encrypted, or text encoded with a different charset.

Practical developer workflows

When this Base64 decoder is useful

Inspect an API field

Decode a documented Base64 property from JSON, compare byte length with the schema, and confirm whether its content is UTF-8, a structured binary message, or an embedded file. Use the JSON formatter first when you need to isolate the field safely.

Read a JWT segment carefully

JWT header and payload segments use unpadded Base64URL. Decoding can make their JSON readable, but it does not verify the signature, algorithm, issuer, audience, expiration, or trustworthiness. Use the JWT-specific decoder to keep those states separate.

Recover an attached file

Decode an encoded fixture, email part, or database export and download the original bytes. Check checksums and the expected media type separately before opening content from an unknown source.

Canonicalize a test vector

Set the exact alphabet, whitespace, and padding policies to catch wrong syntax or pad bits, then compare canonical standard Base64 with unpadded Base64URL. This helps test serializers without treating two spellings of the same bytes as unrelated payloads.

Questions answered

Base64 decoder FAQ

How do I decode a Base64 string to text?

Paste the string into the decoder and keep alphabet detection on Auto unless the source specifies a variant. If the recovered bytes form valid UTF-8, the text view shows the result. If not, use hex or download because the content may be binary or use another character encoding.

Can this decoder handle Base64URL without padding?

Yes. Select Base64URL or use Auto, then choose “Allow omitted padding” for general unpadded input or “Forbid = padding” when the protocol requires the unpadded form. Set whitespace to Reject for JWT/JWS segments. Read the Base64URL guide for alphabet and protocol details.

Why does Base64 sometimes end with one or two equals signs?

= marks an incomplete final 24-bit group. One source byte needs two padding symbols and two source bytes need one. Padding carries no new payload byte; it makes the final standard Base64 group explicit and a multiple of four characters.

What is strict canonical Base64 validation?

It checks the allowed alphabet, length, padding placement, whitespace policy, and unused pad bits. Canonical validation matters when textual equality, signatures, cache keys, or deterministic output require exactly one encoded representation for a byte sequence.

Can Base64 decoding damage Unicode characters?

The Base64 step only recovers bytes. Damage occurs when those bytes are interpreted with the wrong character set or when an application replaces invalid sequences. LiveParse displays text only when the complete result is valid UTF-8, otherwise it preserves the bytes as hex or a file.

Is it safe to preview a decoded image?

The tool previews only bytes recognized as PNG, JPEG, GIF, or WebP raster formats. It does not render decoded SVG or HTML because those can contain active content. A preview still does not prove the file is benign, so treat unknown data cautiously.

Does Base64 decoding decrypt the input?

No. Ordinary Base64 has no encryption key and provides no confidentiality. If decoded bytes are ciphertext, you still need the correct encryption algorithm, key, nonce, authentication tag, and protocol context. Encoding and encryption solve different problems.

Is my Base64 input uploaded?

The decode operation and selected file reading happen in the current browser tab; input is not sent to a conversion API. Normal page assets and device software are separate from the conversion itself. See the privacy page for the full processing explanation.