To decode Base64, paste the encoded string into a Base64 decoder and read the result: SGVsbG8sIHdvcmxkIQ== becomes Hello, world!. Our free Base64 decoder does it in one click in any browser, and the Base64 to image tool previews encoded pictures. The decoder accepts URL-safe Base64, a pasted data: prefix and missing padding, and shows an error when the input isn't Base64 at all. If the result still comes out as gibberish, the data usually was never text in the first place, or several strings were joined together. This guide shows how to tell which, and how to fix each one.
The tools are free and need no account to start. Guests get 5 tool uses a day, and a free My Botsy account (100% free, no spam) removes that daily cap. Every example below was run on October 30, 2026 through our tools or the exact decoding code they use, and the outputs are copied exactly as they came back.
What Base64 is (and what it isn't)
Base64 turns any bytes (text, an image, a PDF) into a string made of just 64 safe characters: A–Z, a–z, 0–9, + and /, with = used as padding at the end. It's defined in RFC 4648 and exists so binary data can travel through systems built for plain text: email attachments, JSON fields, HTTP headers, HTML and CSS.
Two facts explain almost every decoding problem:
- Every 3 bytes become 4 characters. That's why encoded data is about a third larger than the original, and why a string's length is normally a multiple of 4 (padding with one or two
=fills the last group). - Base64 is encoding, not encryption. There's no key. Anyone who sees a Base64 string can decode it in a second, so it never protects a password or a token. If something sensitive is "hidden" in Base64, treat it as plain text.
How to decode Base64 online, step by step
- Copy only the encoded part. Leave out labels such as
Authorization: Basic. Adata:...;base64,prefix is removed for you, and line breaks and spaces inside the string are fine. - Paste it into the Base64 decoder and press Submit.
- Read the result. If it's readable text, you're done. Use the copy button to grab it.
- If you see stray symbols, question marks or an error, check whether the data is binary (an image or file) or whether several strings were joined, using the troubleshooting section below.
- If it's an image, paste the same string into Base64 to image instead to see and download the picture.
Worked examples (real tool output)
Example 1: plain text
Input: SGVsbG8sIHdvcmxkIQ==
Output: Hello, world!
Thirteen characters of text became 20 characters of Base64, the last two being padding. This is the classic test string, and a good way to check any decoder before you trust it.
Example 2: accents and other non-English characters
Input: Q2Fmw6kgY29uIGxlY2hl
Output: Café con leche
Base64 doesn't know about characters, only bytes. The é was stored as two UTF-8 bytes, and our decoder hands those bytes back as UTF-8, so it shows correctly. If a decoder treats the bytes as Latin-1 instead, you'd see Café, which is the tell-tale sign of a character-set mismatch rather than a Base64 problem.
Example 3: a Basic Auth header
An HTTP header like Authorization: Basic dXNlcjpwYXNz carries a username and password joined by a colon. Decoding dXNlcjpwYXNz gives user:pass. That's the whole "protection", which is why Basic Auth must only ever be sent over HTTPS. If you find a header like this in logs or a shared screenshot, assume the password is exposed and change it (our guide to strong passwords covers what to change it to).
Example 4: a JWT payload
JSON Web Tokens are three Base64 parts joined by dots: header, payload and signature. They use the URL-safe alphabet (RFC 4648 section 5), where - replaces + and _ replaces /, and they drop the = padding. We pasted this payload into the decoder:
eyJzdWIiOiI0MiIsIm5leHQiOiIvZG9jcz9wYWdlPTIiLCJuYW1lIjoiWm_DqyJ9
Notice the _ near the end. Until October 30, 2026 our decoder silently skipped it, so the output started correctly and then turned into garbage symbols. It now reads the URL-safe alphabet directly, and the string decodes cleanly:
{"sub":"42","next":"/docs?page=2","name":"Zoë"}
Missing padding isn't a problem either: the decoder adds it back for you. Once you have the JSON, paste it into the JSON validator and beautifier to read it formatted. Only the first two JWT parts are JSON; the third is a binary signature and will always look like noise.
Example 5: a Base64 image
We pasted the 100-character Base64 of a 4×4 red PNG (it starts with iVBORw0KGgo, which is how every PNG begins in Base64) into Base64 to image. It displayed the picture with download options. In a browser test, the same data also loaded fine with line breaks inserted, with its == removed, and with the data:image/png;base64, prefix left on (the tool used to fail on a pasted prefix; that was fixed on October 30, 2026). If the text isn't a real image, the tool says so instead of showing a broken picture.
Handy signatures for guessing what binary Base64 contains: iVBORw0KGgo is PNG, /9j/ is JPEG, R0lGOD is GIF, JVBERi0 is PDF and UEsDB is a ZIP file (which includes .docx and .xlsx).
Why your decoded Base64 looks like gibberish
It's URL-safe Base64
Look for - or _. They appear in JWTs, many API tokens and some URLs. Our decoder handles them as they are, but some other decoders and libraries need you to swap - for + and _ for / first. If the token sits inside a URL and contains %2B, %2F or %3D, run it through the URL decoder first, because those are percent-encoded +, / and =.
The prefix is still attached
We decoded data:text/plain;base64,SGVsbG8sIHdvcmxkIQ== as a test. Our decoder now removes the prefix and returns Hello, world!. Many other decoders don't: the letters in data, text, plain and base64 are all valid Base64 characters, so they get decoded too and you get about 15 junk bytes before the text (our tool did that too before October 30, 2026). Elsewhere, delete everything up to and including the comma.
The data isn't text
Decoding a PNG, PDF or ZIP as text always produces symbols, because those bytes were never letters. Check the first characters against the signatures above, then use Base64 to image for pictures. For other files, decode them with one of the commands below into a file and check its real type with the file MIME type checker.
Several strings were joined together
Padding marks the end of a Base64 string. SGVsbG8=V29ybGQ= is two strings stuck together. Our decoder rejects it with an error, and lenient decoders give Hello followed by junk. Split at each = that isn't at the very end and decode the parts separately.
It was never Base64
Our decoder checks the input, so not base64! gets a clear "This is not valid Base64" error instead of 6 bytes of nonsense (it used to decode it anyway). Hex strings (only 0–9 and a–f) and random IDs can look like Base64 too. If nothing above explains the result, the string may simply be something else.
Decode Base64 without a website
For tokens, passwords, private keys or customer data, don't paste them into any website, including ours. Our decoder runs on our server, so the text you submit leaves your computer. These built-in commands decode locally:
- Linux:
echo 'SGVsbG8sIHdvcmxkIQ==' | base64 --decode - macOS:
echo 'SGVsbG8sIHdvcmxkIQ==' | base64 -D(newer versions also accept--decode) - Windows PowerShell:
[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('SGVsbG8sIHdvcmxkIQ==')) - Python:
base64.b64decode(s), orbase64.urlsafe_b64decode(s)for the URL-safe alphabet (it needs the padding put back) - Browser console:
atob('SGVsbG8sIHdvcmxkIQ=='), which only handles plain ASCII text correctly; for accents wrap the bytes withTextDecoder
To write a decoded file instead of printing it, redirect the output, for example base64 --decode file.b64 > file.pdf.
Encoding the other way
To create Base64, use the Base64 encoder for text and image to base64 for pictures. The text encoder encodes exactly what you type: It's becomes SXQncw==, and HTML tags are kept. Until October 30, 2026 it ran the site's input cleaning first, which removed anything inside <...> and turned It's into SXQmIzM5O3M=. That is fixed, so if you saved output from the old version, encode it again.
Common mistakes
- Treating Base64 as a secret. It hides nothing. Never store passwords or API keys "encrypted" in Base64.
- Decoding a whole JWT at once. Split at the dots and decode the first two parts separately.
- Copying the quotes. In JSON and code, the string sits between quotes. Copy what's inside them only.
- Expecting a conversion to shrink the file. The Base64 to image downloads now really convert (a PNG saved as JPG or WEBP is re-encoded, and the original format is offered as-is), but they don't optimize. To shrink an image, use the image optimizer (see our image compression guide).
- Inlining big images as Base64. Data URIs are a third bigger than the file and can't be cached separately. They're worth it only for tiny icons.
Decode your string now
Paste it into the Base64 decoder. If it's a picture, use Base64 to image, and if it's JSON, finish in the JSON validator (our guide on fixing invalid JSON helps if it won't parse). All of them are free, and you don't need an account to start.
Frequently asked questions
How do I know if a string is Base64?
It uses only A–Z, a–z, 0–9, + and / (or - and _ in the URL-safe variant), its length is usually a multiple of 4, and it may end in one or two = signs. Decoding it is the real test: readable text or a known file signature means you guessed right.
Why does my decoded Base64 show strange characters?
Usually because the data is binary, like an image, or is several strings joined together. Some decoders also fail on URL-safe Base64 with - and _ or on a data: prefix; ours handles both. Fix the input and decode again.
Is Base64 encryption?
No. Base64 is a reversible encoding with no key, so anyone can decode it. Use it to transport data, never to protect it.
How do I convert Base64 to an image?
Paste it into a Base64 to image tool. Ours accepts it with or without the data:image/...;base64, prefix. A string starting with iVBORw0KGgo is a PNG and one starting with /9j/ is a JPEG.
Can I decode Base64 without padding?
Usually yes. Our decoder and most lenient decoders accept strings without the = padding. Strict decoders such as Python's b64decode need it added back until the length is a multiple of 4.
Is the My Botsy Base64 decoder free?
Yes. It's free and works in any browser. Guests get 5 tool uses a day with no account, and a free My Botsy account, with no spam, removes that daily cap.
