Base64 Decoder
What Is Base64 Decoding?
Base64 decoding is the reverse of Base64 encoding: it converts a Base64-encoded string back into its original binary or text representation. When you receive a Base64 string in an API response, HTTP header, database field, or email attachment, you need a decoder to recover the original data. Base64-encoded strings are easily recognizable β they consist entirely of letters, digits, +, /, and trailing = padding characters, and they are always approximately 33% longer than the original data. Decoding is a lossless operation: the output is byte-for-byte identical to the original input before encoding. This tool decodes both standard Base64 (RFC 4648) and URL-safe Base64 (which uses - and _ instead of + and /), covering the full range of real-world use cases you'll encounter in web and API development.
How to Use the Base64 Decoder
- Paste the Base64-encoded string into the input field. Make sure to include any trailing
=padding characters. - Click "Decode" to convert the Base64 string back into its original text or data representation.
- Review or copy the decoded output β if the original data was plain text you'll see it immediately; if it was binary data you can inspect the raw bytes.
The decoder handles whitespace and line breaks gracefully, so you can paste multi-line Base64 strings (common in PEM certificates) without pre-processing.
Common Use Cases
- Decoding JWT tokens: Base64-decode the header and payload sections of a JSON Web Token to inspect its claims.
- Reading API responses: Decode Base64-encoded fields in API responses that contain file content, images, or binary data.
- Inspecting email headers: Decode Base64-encoded email subjects, bodies, and attachments in raw email source.
- Debugging HTTP Basic Auth: Decode the value after "Basic " in an Authorization header to see the username and password.
- PEM certificates: Decode Base64 blocks in
.pemfiles to inspect certificate data and key material. - Security research: Decode obfuscated Base64 payloads found in malware samples, phishing scripts, or suspicious code.