Base64 Decoder
Decode Base64 back to readable text. Standard and URL-safe alphabets both work, padded or not, and line breaks in pasted input are ignored.
Your data never leaves your browser. This tool runs entirely on your device.
What Base64 actually does
Base64 rewrites arbitrary bytes using only 64 characters that survive systems built for text: A-Z, a-z, 0-9, plus and slash. Every three bytes become four characters, which is why the output is always about 33% larger than the input.
It exists because email, JSON, XML and URLs were designed to carry text. Putting raw binary through them corrupts the data, so it is encoded first and decoded at the other end.
3 bytes → 4 characters (33% larger)
Base64 is not encryption
This is the single most important thing to understand about it. Base64 is a reversible encoding with no key: anyone can decode it instantly, as this page demonstrates. It provides no confidentiality whatsoever.
Putting a password or an API key in Base64 to "hide" it is a real and common security mistake. If something must stay secret, it needs actual encryption.
Standard and URL-safe variants
Standard Base64 uses + and / which both have special meanings in a URL, and = padding which can be mangled by some systems. The URL-safe variant swaps + for - and / for _, and usually drops the padding.
JSON Web Tokens use the URL-safe form, which is why a JWT contains dashes and underscores but never a plus, slash or equals sign.
Frequently asked questions
Is Base64 encryption?
No. It is an encoding, not encryption. There is no key and anyone can reverse it instantly. It provides no security at all — never use it to protect a secret.
Why is my Base64 output larger than the input?
Because every 3 bytes become 4 characters, so the output is roughly 33% bigger, plus up to two characters of padding. That overhead is the cost of making binary data safe to put in text.
What do the equals signs at the end mean?
They are padding. Base64 works in blocks of three bytes, so when the input length is not a multiple of three, one or two = characters pad the final block. Many decoders, including this one, accept input without them.
What is URL-safe Base64?
A variant that replaces + with - and / with _, because those two characters have special meanings in URLs. Padding is usually dropped as well. JSON Web Tokens use this variant.
Why does my Base64 decode to gibberish?
Usually because it is not text. Images, compressed archives and encrypted blobs are all commonly Base64-encoded, and decoding them produces raw bytes that cannot be displayed as characters. This tool tells you when that is what happened.
Related tools
- Base64 EncoderEncode any text to Base64, including emoji and non-Latin scripts. Switch to the URL-safe alphabet when the result has to travel in a URL.
- URL DecoderDecode a percent-encoded URL back to readable text. If the result is a full URL, its query parameters are broken out so you can see what it carries.
- JWT DecoderPaste a JSON Web Token to read its header and payload. Timestamp claims are expanded into readable dates, and the token never leaves your browser.
- JSON FormatterPaste JSON to pretty-print it with consistent indentation, or minify it back down. Invalid JSON is reported with the exact line and column so you can find the problem.