How to Decode Base64 Online
Paste Base64 and select Decode to recover UTF-8 text. Whitespace is ignored and URL-safe alphabet characters are normalized. If decoding fails, check whether you copied a complete payload rather than a whole data URI or JWT.
Standard Base64 vs Base64URL
Standard Base64 uses plus and slash; Base64URL uses hyphen and underscore. URL-safe input may omit equals padding. These are alphabet conventions for the same kind of byte representation, not separate encryption methods.
Decoding Text, Unicode and Binary Data
Decoding first recovers bytes and then interprets them as UTF-8. Arbitrary binary files are not necessarily text and can fail this step. Use Image to Base64 for supported image data rather than assuming all decoded bytes should be readable.
Why Base64 Is Encoding, Not Encryption
The phrase base64 decrypt is misleading: no secret key is involved. Base64 is reversible encoding. Decoding does not authenticate a payload or establish that its content is trustworthy.
Common Base64 Decode Errors
Invalid characters, incomplete groups, misplaced padding and non-UTF-8 bytes can cause errors. A JWT contains separately encoded segments; use JWT Decoder for its structure. Remove a data URI prefix before decoding only the Base64 payload as text.
More examples and technical details
How Base64 Decoding Works
Decoding runs the encoding pipeline backwards. Each Base64 character is looked up in the 64 character alphabet to recover the 6 bit value it represents. Four of those values are concatenated into a 24 bit block, and that block is sliced back into three 8 bit bytes. Padding at the end tells the decoder how many of those bytes are real.
- Strip any whitespace and line breaks, which carry no meaning.
- Convert each character to its index in the alphabet, 0 to 63.
- Join four indexes into a single 24 bit block.
- Split the block into three bytes, most significant bits first.
- Discard one byte for every trailing equals sign, then interpret the bytes.
Worked Example: Decoding "SGVsbG8="
This string has eight characters, one of which is padding, so it decodes to five bytes rather than six.
Why Decoding Fails
Base64 is strict about shape, and most failures come from a handful of causes:
- Invalid characters. Anything outside A-Z, a-z, 0-9, plus, slash, and equals is rejected. Copying from a chat client that inserts smart quotes or a zero width space is a frequent culprit.
- Wrong length. Standard Base64 length must be a multiple of four once padding is included. A truncated copy and paste is the usual cause.
- Missing padding. Many producers strip trailing equals signs. Add them back until the length divides by four.
- URL-safe input in a standard decoder. Dashes and underscores are not in the standard alphabet and must be translated first.
- Double encoding. If the decoded output is itself another valid looking Base64 string, the value was probably encoded twice.
Standard Base64 vs URL-Safe Base64
Standard Base64 uses plus and slash for indexes 62 and 63. Both are awkward in a URL: slash is a path separator and plus means a space in form encoded data. RFC 4648 section 5 therefore defines a URL and filename safe variant.
JSON Web Tokens always use the URL-safe form without padding, which is why a JWT segment pasted into a strict standard decoder often fails. Convert dash to plus, underscore to slash, and pad the length up to a multiple of four before decoding.
Is the Decoded Output Text or Binary?
Base64 carries no type information, so the decoder cannot tell you what the bytes mean. If the result renders as readable words or valid JSON, it was text, almost always UTF-8. If you see replacement characters, control codes, or unprintable symbols, the payload was binary. A short signature at the start is often enough to identify it: bytes 89 50 4E 47 mean PNG, FF D8 FF means JPEG, 25 50 44 46 means PDF, and 50 4B 03 04 means a ZIP archive (which includes .docx and .xlsx files).
The Base64 Alphabet
Every 6 bit group produces a value between 0 and 63, and that value is looked up in the table below. RFC 4648 fixes this ordering: uppercase letters first, then lowercase, then digits, then the plus and slash characters. The padding character (=) is not part of the alphabet, it only marks the end of an incomplete group.
| Index | Char |
|---|---|
| 0 | A |
| 1 | B |
| 2 | C |
| 3 | D |
| 4 | E |
| 5 | F |
| 6 | G |
| 7 | H |
| 8 | I |
| 9 | J |
| 10 | K |
| 11 | L |
| 12 | M |
| 13 | N |
| 14 | O |
| 15 | P |
| Index | Char |
|---|---|
| 16 | Q |
| 17 | R |
| 18 | S |
| 19 | T |
| 20 | U |
| 21 | V |
| 22 | W |
| 23 | X |
| 24 | Y |
| 25 | Z |
| 26 | a |
| 27 | b |
| 28 | c |
| 29 | d |
| 30 | e |
| 31 | f |
| Index | Char |
|---|---|
| 32 | g |
| 33 | h |
| 34 | i |
| 35 | j |
| 36 | k |
| 37 | l |
| 38 | m |
| 39 | n |
| 40 | o |
| 41 | p |
| 42 | q |
| 43 | r |
| 44 | s |
| 45 | t |
| 46 | u |
| 47 | v |
| Index | Char |
|---|---|
| 48 | w |
| 49 | x |
| 50 | y |
| 51 | z |
| 52 | 0 |
| 53 | 1 |
| 54 | 2 |
| 55 | 3 |
| 56 | 4 |
| 57 | 5 |
| 58 | 6 |
| 59 | 7 |
| 60 | 8 |
| 61 | 9 |
| 62 | + |
| 63 | / |
Working on something related? Browse every free developer tool on the site, including a Base64 encoder, JWT decoder, URL decoder, and JSON formatter. Everything runs entirely in your browser, so nothing you paste is ever uploaded.
Standards and references
Frequently asked questions
How do I decode a Base64 string?
Paste the encoded string in Decode mode and read or copy the text output.
Can Base64 be decrypted?
Base64 is decoded, not decrypted. It does not provide encryption or require a secret key.
What is the difference between Base64 and Base64URL?
Base64URL changes plus and slash to hyphen and underscore and often omits padding.
Why does a Base64 string fail to decode?
The input may be malformed, incomplete, include a wrapper prefix, or represent bytes that are not valid UTF-8 text.
Is decoded content sent to a server?
No. Input is processed in this browser tab and is not uploaded by the tool. Copy and download are actions you control; ordinary page analytics do not receive tool input.