Base64 Decode

Overview

Turn a Base64 string back into the text it came from. The panes are linked: paste Base64 on one side to read it, or edit the text and see the new Base64 appear. It handles standard and URL-safe Base64, refuses malformed input instead of guessing, and reads the result as UTF-8. It runs in your browser, so pasting a secret or a token is fine.

Reading a JWT payloadPaste the middle part of a token, choose URL-safe, and read the JSON claims without any key.
Kubernetes and CI secretsCheck what a Base64 secret really holds without leaving it in your shell history.
Debugging a config valueDecode a Base64-wrapped setting to see whether the value or the wrapping is wrong.
Catching a bad encoderMixed-alphabet strings are refused, which points you straight at the service encoding inconsistently.
Editing and re-encodingChange the decoded text and read the new Base64 beside it, in one step instead of three.

Set

Security Tools 26

Neighbours

01 AES File & Text Encryptor 02 Base64 Encode 03 CSR Generator 04 DER to PEM Converter 05 Hash Generator 06 JWT Sign

Specification

Command: security.base64_decode
Set: Security
Input: text
Output: —
Max file: no limit
Batch: single file

Runtime

Engine: WebCrypto · OpenPGP.js
Threads: single
Isolated: —
WebGPU: —
Memory: —

Transport 0 B

Your file is opened, worked on and saved inside this tab. This tool has no upload step, so your file has nowhere else to go.

Keys

Search: ⌘K
Panels: ⌘1 · ⌘2
Full width: F
All keys: ⌘/

How it works

Paste the Base64

The decoded text appears beside it, and editing either pane updates the other.

Pick the alphabet

Standard, or URL-safe (- and _ instead of + and /); Unicode and emoji come back intact.

Copy the result

Both panes stay visible, so you can check the round trip before you copy.

Frequently asked

How do I know if text is Base64 encoded?

Base64 uses only letters, digits, + and / (or - and _ when URL-safe), sometimes ending in one or two =. It looks like a long run of random characters with no spaces. The surest test is to decode it and see if the result makes sense.

Is the decoding process secure?

It runs in your browser. What you paste and what comes out are never sent anywhere or stored, which matters when it's a secret from a manifest or a token from a log.

What happens if the Base64 is invalid?

You get an error, not wrong bytes that look right. A string that mixes both alphabets (+ or / alongside - or _) is refused too, because guessing which one was meant could silently decode the wrong bytes.

Does Unicode come back intact?

Yes. The bytes are read as UTF-8, so accents, non-Latin scripts and emoji come back exactly as they went in.

Keys

Search: ⌘K
Panels: ⌘1 · ⌘2
Full width: F
All keys: ⌘/