Base64 Decode Online: Instantly Decode Any Base64 String for Free

You’ve got a Base64 string — a JWT payload, an image in an API response, a config value in an environment file. You need the original content now, not after installing a tool or writing a decode script.

Decode Base64 Online →

---

What Is Base64?

Base64 is an encoding scheme that converts binary data into ASCII text using 64 printable characters (A–Z, a–z, 0–9, +, /) plus = for padding.

It’s not encryption — it provides zero security. Anyone can decode it instantly. The purpose is safe transport: binary data often breaks systems that only handle text (email, HTTP headers, JSON, HTML attributes).

What Base64 looks like

Original: Hello, World!

Base64: SGVsbG8sIFdvcmxkIQ==

---

When You’ll Need to Decode Base64

JWT Tokens (Most Common)

JWTs have three Base64-encoded parts separated by dots:

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

Decode the middle section (payload):

{
  "sub": "1234567890",
  "name": "John Doe",
  "iat": 1516239022
}

API Responses with Image Data

{
  "image": "iVBORw0KGgoAAAANSUhEUgAA..."
}

That’s a PNG or JPEG encoded as Base64. Decode it to get the actual file.

HTTP Basic Auth Headers

Authorization: Basic dXNlcjpwYXNzd29yZA==

Decode dXNlcjpwYXNzd29yZA== → user:password

Environment Variables

Some tools store configuration as Base64 to avoid escaping issues:

DATABASE_URL=cG9zdGdyZXNxbDovL3VzZXI6cGFzc0Bob3N0OjU0MzIvZGI=

SSH Keys and Certificates

PEM files contain Base64-encoded key material between the -----BEGIN----- and -----END----- lines.

---

Standard Base64 vs URL-Safe Base64

There are two variants:

Variant	Characters used	Padding
Standard	+ and /	=
URL-safe	- and _	Sometimes omitted

URL-safe Base64 replaces + → - and / → _ so the encoded string can appear in URLs without percent-encoding.

JWTs use URL-safe Base64 without padding.

If decoding fails, try switching variants.

---

How to Decode Base64 in Code

JavaScript (Browser + Node.js)

// Decode
const encoded = "SGVsbG8sIFdvcmxkIQ==";
const decoded = atob(encoded);
console.log(decoded); // "Hello, World!"

// Node.js (Buffer)
const buf = Buffer.from("SGVsbG8sIFdvcmxkIQ==", "base64");
console.log(buf.toString("utf-8")); // "Hello, World!"

// URL-safe Base64 decode (Node.js)
function decodeBase64Url(str) {
  str = str.replace(/-/g, "+").replace(/_/g, "/");
  while (str.length % 4) str += "=";
  return Buffer.from(str, "base64").toString("utf-8");
}

// Decode JWT payload
function decodeJwtPayload(token) {
  const payload = token.split(".")[1];
  return JSON.parse(decodeBase64Url(payload));
}

Python

import base64

# Standard decode
encoded = b"SGVsbG8sIFdvcmxkIQ=="
decoded = base64.b64decode(encoded).decode("utf-8")
print(decoded)  # "Hello, World!"

# URL-safe decode
url_safe = "SGVsbG8sIFdvcmxkIQ"
decoded = base64.urlsafe_b64decode(url_safe + "==").decode("utf-8")

# Decode binary file
import base64
with open("output.png", "wb") as f:
    f.write(base64.b64decode(image_base64_string))

Bash / Command Line

# Decode
echo "SGVsbG8sIFdvcmxkIQ==" | base64 -d
# Hello, World!

# Decode a file's Base64 content
base64 -d encoded.txt > output.bin

# Decode and pipe to jq (for Base64-encoded JSON)
echo "eyJrZXkiOiJ2YWx1ZSJ9" | base64 -d | jq .

Go

import (
    "encoding/base64"
    "fmt"
)

encoded := "SGVsbG8sIFdvcmxkIQ=="
decoded, err := base64.StdEncoding.DecodeString(encoded)
if err != nil {
    panic(err)
}
fmt.Println(string(decoded)) // "Hello, World!"

// URL-safe
decodedUrl, err := base64.URLEncoding.DecodeString(encoded)

---

Troubleshooting Decode Errors

”Invalid character” or “Incorrect padding”

Base64 strings must have a length that’s a multiple of 4. If padding is missing, add = signs:

// Fix padding
const fixPadding = (str) => str + "=".repeat((4 - str.length % 4) % 4);

Getting garbage output

If decoded output looks garbled, the encoding might be:

• URL-safe Base64 (try replacing -→+ and _→/)
• Multi-layer encoded (decode twice)
• A different charset (try Latin-1 instead of UTF-8)

Input contains whitespace

Encoded strings sometimes have newlines inserted for readability. Strip whitespace before decoding:

const cleaned = encoded.replace(/\s/g, "");

---

Real-World Scenario: Debugging a Failing JWT Authentication

You’ve deployed a new API and users are getting 401 Unauthorized errors. Your backend validates JWTs, but the errors are cryptic. The fastest way to diagnose this is to grab a token from a failing request and inspect its payload — no debugger required.

Copy the token from the Authorization header in the browser’s Network tab. A JWT looks like three dot-separated segments: header.payload.signature. The header and payload are both URL-safe Base64 encoded. Decode the payload (middle segment) with your Base64 decoder tool and you’ll immediately see the claims: sub (user ID), exp (expiration timestamp), iat (issued at), and any custom claims your backend set. A common cause of 401s is an expired token — check if exp is in the past. Another is a missing or misspelled claim that your middleware requires, like role or tenant_id.

Once you’ve identified the issue, you can verify the fix by inspecting a freshly issued token the same way. Keep the decoder tool open during auth development — it saves round-trips through logs and lets you confirm the token shape matches what your middleware expects before writing a single test.

---

Quick Tips

1. Never paste production tokens into public online tools. If a JWT contains a live user’s session or sensitive claim data, decode it locally using echo "PAYLOAD" | base64 -d in your terminal, or in your browser console with atob().

2. When a decode fails with a padding error, try adding == to the end. URL-safe Base64 (used in JWTs) strips trailing padding. Most tools handle this automatically, but if you’re decoding manually, padding must be restored to a multiple of 4 characters.

3. Check for multi-layer encoding. If decoded output still looks like Base64, decode it again. Some systems double-encode values, particularly when Base64-encoded JSON is stored inside another Base64-encoded field.

4. Use Base64 to safely pass binary data in JSON APIs. When your API needs to accept file uploads as JSON (not multipart), encode the file as Base64 on the client and decode it on the server. This avoids encoding issues at the cost of a ~33% size increase.

5. Strip all whitespace before decoding. PEM certificate files and SSH keys insert newlines every 64 characters for readability. If you’re decoding the key body programmatically, remove newlines first or the decoder will fail.

---

Is Decoding Base64 Safe?

Decoding doesn’t pose a security risk by itself. However:

• Don’t decode tokens in public tools if they contain sensitive credentials
• Base64 ≠ encryption — never use it to “hide” passwords
• Validate decoded output — ensure it’s the format you expect before using it

For sensitive production data, decode client-side (in browser or local terminal) rather than sending data to a third-party service.

---

Related Tools

• Base64 Encoder & Decoder — encode and decode in one place
• JWT Decoder — decode and inspect JWTs with signature verification
• JSON Formatter — format JSON after Base64 decoding

---

Conclusion

Base64 decoding is a daily task for developers — JWT debugging, API payload inspection, credential management. A reliable Base64 decoder online saves you from writing throwaway scripts.

Decode Base64 Online for Free →