Base64 decoder

Paste Base64 on the left, read the text on the right. Whitespace and line breaks are ignored, so you can paste straight out of an email header or a log file.

If the result comes back empty or wrong, check Variant first. A string full of - and _ is URL-safe Base64 and needs that setting rather than Standard.

Most people arrive with one of four things. A JSON Web Token, which you can spot because it starts with eyJ every time, that being what {" encodes to. It is three Base64url chunks separated by dots, and decoding the middle one shows the claims while proving nothing about whether the token is valid. A data URI from a stylesheet or an email, where the Base64 starts after the comma in data:image/png;base64,iVBOR — and iVBOR is how every PNG begins. An API key or certificate. A chunk of an email attachment.

Only the first and last are likely to be readable. A certificate decodes to bytes that were never characters, and the tool will say so rather than printing noise at you.

Three things usually go wrong: the string was cut short so its length no longer divides by four, it uses the URL-safe alphabet and the variant needs switching, or it was never Base64 and the first foreign character gives it away.

The error names the character at fault and what the alphabet allows. If you aren't certain the message is Base64 in the first place, the cipher identifier will test it against everything else.

Going the other way is the encoder. For the raw bytes, try binary; for the number behind each character, character codes.

Base64 is often just the outer layer. If your decode produces more gibberish, feed the result to the cipher identifier.