Decode a Base64 string back to readable text, with clear errors for invalid characters, wrong length and bad padding. Binary results can be shown as a hex dump instead.
Show calculation steps
Processed privately in your browser — nothing you paste is uploaded, logged or stored.
How to use the Base64 Decoder
- Paste the Base64 string into the input panel. Line breaks and spaces are ignored automatically.
- Leave "Strict alphabet" off to accept both the standard (+ /) and URL-safe (- _) alphabets; turn it on to reject the wrong variant.
- If the data is binary rather than text, set "If not text, show bytes as" to "Hex dump".
- Click "Decode Base64" and copy the recovered text.
Frequently asked questions
Why do I get an "invalid length" error?
A Base64 string always has a length that is a multiple of four once padding is included. A remainder of exactly one is impossible in valid Base64, so that error means characters are missing – usually a truncated copy and paste.
The decoder says my input contains an invalid character. What now?
Standard Base64 uses only A-Z, a-z, 0-9, plus and slash, with "=" for padding. The error names the offending character and its position. Common causes are a stray quotation mark from a JSON snippet, a hyphen or underscore from the URL-safe variant, or text accidentally included around the encoded data.
My decoded output is unreadable symbols. Why?
The Base64 held binary data such as an image, archive or ciphertext rather than text. Switch the binary option to "Hex dump" to inspect the raw bytes. Unreadable output can also mean the original text used a legacy character set rather than UTF-8.
Does the tool accept Base64 copied from a JWT?
Yes. JWT sections use the URL-safe alphabet without padding, and the forgiving default handles both. For token work the Base64URL Decoder and the JWT Decoder give more relevant context.
Is anything I paste here uploaded?
No. Decoding runs entirely in your browser using JavaScript. The pasted string is never transmitted, never logged and never stored, and analytics records only that a decode happened – never the content.
