Base64 Decode

Why decoding fails

• Invalid characters: only A–Z, a–z, 0–9, +, / (or -, _) and = are allowed. The status line shows the position of the first offender.
• Binary data: if the bytes are an image, a PDF or a ZIP archive, they are not text. Save them with a file decoder instead of reading them here.
• Truncated input: a single leftover character cannot be decoded. Check that you copied the whole string, including any trailing equals signs.

Line breaks, as in PEM certificates and MIME e-mail bodies, and missing = padding are accepted automatically.

How to recognise Base64

Typical signs: a long run of letters and digits without spaces, a length divisible by four, and one or two = at the end. Strings starting with eyJ are usually Base64-encoded JSON, because {" always encodes to those three characters — the first two parts of every JWT start that way.

Decoding a token only reveals its contents; payload claims like expiry dates, user identifiers and granted scopes are readable by anyone holding it. It does not prove the token is genuine; signature verification needs the issuer's key.

Decoding in code

• JavaScript: new TextDecoder().decode(Uint8Array.from(atob(b64), (c) => c.charCodeAt(0))) keeps UTF-8 intact; atob alone garbles accented letters.
• Python: base64.b64decode(s).decode('utf-8'); add validate=True to reject stray characters.
• Shell: base64 --decode file.txt on Linux, base64 -D on older macOS.

The tool works with any Unicode text: it converts text to UTF-8 bytes first, so accented letters and emoji survive the round trip. It runs entirely in your browser; nothing is sent to a server.

Need the opposite? Use Base64 encode.