Base64 decoder

Turn a Base64 string back into readable text

You'll run into Base64 strings all over the web: in HTTP headers, JSON payloads, email source code, configuration files and tokens. They look like random letters, often ending in one or two = signs. This decoder converts them back to the original text so you can see what they contain.

For example, SGVsbG8sIEJvdHN5IQ== decodes to Hello, Botsy!. Paste the string, submit, and read the result.

If the decoded output looks like garbled symbols, the original data probably wasn't text. It may be an image, a compressed file or encrypted data. For images, try the Base64 to image converter.

How to use the base64 decoder

1. Paste the Base64 string into the content box. Leave out any prefix such as Basic or data:...;base64,.
2. Submit to decode.
3. Read or copy the decoded text.

Examples

Plain text

Input: TXkgQm90c3kgdG9vbHM=

Output: My Botsy tools

Accented text

Input: w7FhbmTDug==

Output: ñandú

UTF-8 text decodes correctly, accents included.

Missing padding

Input: SGVsbG8gd29ybGQ

Output: Hello world

The missing = at the end doesn't matter here.

Common uses

• Checking what's inside an HTTP Basic Authorization header while debugging.
• Reading the header and payload parts of a JWT (they are Base64URL encoded JSON).
• Inspecting Base64 values in Kubernetes secrets, environment variables or config files.
• Reading encoded parts of an email's raw source.
• Verifying the output of your own code that produces Base64.

Tips and things to know

• If decoding fails, check for missing = padding, stray spaces or line breaks, or characters that aren't part of the Base64 alphabet.
• JWTs and some APIs use URL-safe Base64, which swaps + and / for - and _. Replace them back before decoding if needed.
• Decoded JSON is easier to read after running it through the JSON beautifier.
• Be careful with tokens and credentials: decoding a token doesn't verify it, and you shouldn't paste live secrets into any website.

Edge cases and limitations

• Invalid characters are skipped silently instead of causing an error. SGVsbG8@IHdvcmxk decodes to "Hello" followed by junk, so gibberish output often means a damaged string.
• URL-safe Base64 (with - and _) decodes wrongly unless you swap those back to + and /: PDw_Pz4- gives junk, PDw/Pz4+ gives <<??>>.
• Binary data such as images or zip files shows as unreadable symbols. Use Base64 to image for pictures.
• Line breaks inside long strings (common in email source) are ignored, so you can paste them as they are.

Frequently asked questions

How can I tell if a string is Base64?

Base64 uses only A–Z, a–z, 0–9, + and /, may end with = padding, and its length is usually a multiple of 4. Those are clues, not proof; the easiest test is to decode it.

Why does the decoded text look like gibberish?

The original data was probably binary, such as an image, a zip file or encrypted bytes, rather than text.

Can I decode a JWT with this?

You can decode the header and payload parts (the first two sections separated by dots). Convert any - and _ to + and / first. Decoding does not check the signature.

Is decoding Base64 the same as decrypting?

No. Base64 is a public encoding with no key. Anyone can decode it, which is why it shouldn't be used to protect secrets.

Related tools

• Base64 encoder: Encode any string input to Base64.
• Base64 to Image: Decode Base64 input to an image.
• URL decoder: Decode URL input to back to a normal string.
• JSON validator & beautifier: Validate JSON content and make it looks good.
• Hex converter: Convert text to hexadecimal and the other way for any string input.