Free · in-browser · padding tolerant
Base64 Decoder
Paste any Base64 string to recover the text it encodes. Missing padding, stray line breaks and the URL-safe alphabet are all handled — and invalid input says so instead of failing silently.
Short answer
To decode Base64, the tool reverses the encoding: every four Base64 characters map back to three bytes, which are then read as UTF-8 text. Paste your string above and the result appears instantly. Common gotchas handled here: missing '=' padding (many APIs strip it), line breaks inside the string, and the URL-safe alphabet where '+' and '/' were replaced by '-' and '_'.
Runs entirely in your browser — Unicode and emoji handled via UTF-8. Base64 is encoding, not encryption.
About Base64
One important caveat: Base64 is encoding, not encryption. Anyone can decode it — this very page proves that. It exists to move binary data through text-only channels (email, JSON, data URLs), not to hide anything. If you see credentials in a Base64 blob, treat them as plaintext.
Base64 examples (including Unicode)
| Text | Base64 | Length |
|---|---|---|
| Hello | SGVsbG8= | 5 → 8 |
| Hello, World! | SGVsbG8sIFdvcmxkIQ== | 13 → 20 |
| user:password | dXNlcjpwYXNzd29yZA== | 13 → 20 |
| héllo | aMOpbGxv | 5 → 8 |
| 日本語 | 5pel5pys6Kqe | 3 → 12 |
| 🎉 | 8J+OiQ== | 2 → 8 |
Base64 always grows the data by about a third (4 output characters per 3 input bytes) — a cost, not a compression.
How we calculate this
Three bytes in, four characters out — with one detail everyone trips over:
- Text → bytes (UTF-8). the text is first encoded as UTF-8 bytes. Skipping this step is why raw btoa() throws on accents and emoji; every correct implementation does it.
- Bytes → Base64. each group of 3 bytes (24 bits) becomes 4 characters of 6 bits from the 64-character alphabet, padded with '=' when the input doesn't divide evenly.
- URL-safe variant. RFC 4648 §5 swaps '+' and '/' for '-' and '_' and drops padding, so the value survives inside URLs, filenames and JWTs.
Assumptions
- Everything runs in your browser — text is never uploaded, stored or logged.
- Decoding tolerates missing padding and whitespace, which many APIs emit; invalid characters are reported rather than silently dropped.
- Base64 is ENCODING, not encryption — anyone can reverse it. Never use it to protect secrets.
Last reviewed: July 30, 2026
Frequently asked questions
What is Base64 used for?+
Moving binary data through channels that only carry text: email attachments (MIME), images inlined in CSS or HTML as data: URLs, binary fields inside JSON, and HTTP Basic Auth headers. It converts any bytes into 64 safe characters, at the cost of making the data about 33% larger.
Is Base64 encryption?+
No — and treating it as such is a real security mistake. Base64 is reversible by anyone with no key and no effort; this page decodes it instantly. It exists to make binary data transport-safe, not private. Credentials seen inside a Base64 blob (HTTP Basic Auth, for instance) should be considered plaintext.
Why does btoa() fail on emoji and accented characters?+
Because btoa() reads its input as Latin-1 code units and throws on anything above U+00FF. The fix is to convert the text to UTF-8 bytes first (TextEncoder) and Base64 those bytes — which is exactly what this tool does, so "héllo" and "🎉" round-trip correctly here while a naive one-liner breaks.
What is URL-safe Base64?+
The RFC 4648 §5 variant: '+' becomes '-', '/' becomes '_', and trailing '=' padding is usually dropped — so the value can sit in a URL, query string, filename or JWT without being re-encoded. Toggle it above; decoding here accepts both alphabets automatically.
Why does my Base64 string have = at the end?+
Padding. Base64 works in 3-byte groups; when the input doesn't divide evenly, one or two '=' characters mark the shortfall. Some systems strip them (URL-safe Base64, many JWT libraries), which is why this decoder restores missing padding automatically instead of rejecting the input.
Is my text uploaded anywhere?+
No. Encoding and decoding happen entirely in your browser — you can check the network tab while typing and see zero requests. That matters here more than on most tools, because people paste tokens, config snippets and credentials into Base64 tools all day.
Also try the Base64 Encoder / Decoder.