What Base64 is
Base64 writes arbitrary bytes using 64 safe characters (A–Z, a–z, 0–9, + and /), so binary data can travel through systems built for text: email attachments (MIME), data URLs, JSON fields, HTTP Basic authentication headers and JWT tokens all use it. Every 3 bytes become 4 characters, so encoded data is about 33% larger than the original. The = signs at the end are padding that makes the length a multiple of four.
The URL-safe variant, Base64url, swaps + and / for - and _ and usually drops the padding, so the result can sit in a URL or filename. JWTs use it. This decoder accepts both alphabets automatically.
Worked example
SGVsbG8sIFV0aWxOZXN0IQ== decodes to Hello, UtilNest!. Group the characters in fours: SGVs → Hel, bG8s → lo, and so on. Each character carries 6 bits, so four characters carry exactly three bytes.
When decoding fails
If the result is not valid UTF-8, the input probably encodes binary data such as an image or a compressed file rather than text. A length that leaves one character over in the last group of four, or characters like $ or %, mean the text was truncated or is not Base64.
How this works
The page follows RFC 4648: it removes whitespace, maps - and _ back to + and /, restores the = padding, and converts each group of four characters (24 bits) into three bytes. The bytes are then read as UTF-8; if they are not valid UTF-8 the page says so rather than showing garbled characters. Switch to Encode to go the other way. Everything runs in this tab, and nothing you paste is sent anywhere.
Frequently asked
Is Base64 encryption?
No. Base64 is an encoding that anyone can reverse without a key. Never use it to hide passwords or secrets.
Why does my decoded text look garbled?
The data is probably binary (an image, a PDF, compressed bytes) or was encoded from a legacy charset such as Latin-1. This page decodes to UTF-8 and reports invalid sequences.
Do I need the = padding?
No. The decoder adds missing padding itself, and also accepts the URL-safe characters - and _ used in JWTs.
Is my data uploaded?
No. Decoding runs entirely in your browser; nothing is sent, stored or logged.
Sources
- RFC 4648 — The Base16, Base32, and Base64 Data Encodings
- The Unicode Standard, latest version
- Wikipedia — Base64
Reviewed Oct 17, 2026 · test vectors fixtures/dev/base64-decode/