Base64 Decode
Decode standard or URL-safe Base64 back to UTF-8 text. Free, and runs entirely in your browser — nothing you enter is uploaded, stored or sent to a server.
About Base64
Base64 rewrites arbitrary bytes as 64 printable ASCII characters so they survive channels that only carry text: JSON string fields, HTTP headers, data URLs, email bodies and a copy-paste into a chat window. Your text is read as UTF-8 first, so accents, CJK and emoji round-trip byte for byte.
The URL-safe alphabet swaps + and / for - and _ and drops the = padding, which is the variant JWTs, OAuth state parameters and query strings use. Decoding accepts either alphabet and tolerates missing padding, so a token pasted straight out of a log still decodes.
Where it helps
- Fully reversible: the bytes that come out are the bytes that went in.
- Runs entirely in this browser, so credentials and personal data never reach a server.
- Handles both the standard and URL-safe alphabets, padded or not.
- Explicit UTF-8 handling keeps non-English text and emoji intact.
Limits
- Base64 is an encoding, not encryption — anyone who sees the output can decode it, so it hides nothing.
- Output is roughly 33% larger than the input, which matters inside size-limited fields.
- Decoding binary such as an image or a gzip stream produces replacement characters, because the result is shown as text.
Frequently asked questions
Is Base64 a way to protect data?
No. There is no key and no secret, so decoding is trivial for anyone. Use Text Encryption when the content must stay confidential.
When should I pick the URL-safe alphabet?
Whenever the value travels in a URL path, query string or cookie — + and / have their own meaning there. JWT segments always use the URL-safe form.
My decoded output is full of question marks. What went wrong?
The decoded bytes are not UTF-8 text — usually a file rather than a string. Decode files with a dedicated tool; this one shows text.
Does the padding matter?
Only for strict parsers. Encoding adds = padding for the standard alphabet and omits it for URL-safe output, and decoding accepts both.
Related tools
- URL Encoder — Percent-encode components or whole URLs
- JWT — Read, verify and sign JSON Web Tokens
- Unicode Converter — Escape, unescape and inspect code points
- Hash Generator — SHA-2, SHA-3, BLAKE and legacy digests, in any encoding
- Base32 — Encode or decode Base32 in the RFC 4648, extended hex and Crockford alphabets
- Base58 — Encode or decode Base58, and verify the Base58Check checksum an address carries
More Encoders & Decoders tools
- Base64 — Encode or decode UTF-8 text and URL-safe Base64
- Base32 — Encode or decode Base32 in the RFC 4648, extended hex and Crockford alphabets
- Base58 — Encode or decode Base58, and verify the Base58Check checksum an address carries
- URL Encoder — Percent-encode components or whole URLs
- HTML Entities — Escape and unescape HTML entities
- JWT — Read, verify and sign JSON Web Tokens
- Punycode — Convert internationalised domain names to and from their ASCII form
- Unicode Converter — Escape, unescape and inspect code points
- Unicode Inspector — Analyse every character: category, script, block and encoding
- Number Base Converter — Binary, octal, decimal and hexadecimal, with the bits explained
- Hex and Text Converter — Text to hexadecimal bytes and back, with a dump
- Gzip Compressor and Decompressor — Compress and expand gzip, zlib and raw deflate