Base64 Decoder

How Base64 Decoding Works

1. 1Paste your Base64 encoded string into the input box. It may end with one or two = padding characters.
2. 2The decoder groups the Base64 characters into sets of 4, converts each group back to 3 bytes using the Base64 alphabet, and reassembles the original byte sequence.
3. 3The decoded text appears instantly. Click Copy to copy it to your clipboard.

Reading JWT Payloads with Base64 Decoding

JSON Web Tokens (JWTs) consist of three Base64url-encoded sections separated by dots: header.payload.signature. The payload section contains claims — user ID, roles, expiry time, issuer, and other metadata — encoded in Base64url. To read the contents of a JWT without a dedicated JWT debugger, take the middle section (between the first and second dot), replace any - with + and _ with /, then paste it into this decoder. The decoded JSON reveals the token's claims.

The Complete Guide to Base64

Base64 is one of those quietly essential technologies that developers use constantly, often without fully understanding what it is doing or why. It shows up in JWTs, email attachments, data URIs, HTTP Basic Auth, Kubernetes secrets, and countless API payloads. Knowing how it works — and, just as importantly, what it does not do — makes you far more effective at debugging and prevents a dangerous misconception about security. This guide explains why Base64 exists, how the encoding actually works, the difference between its variants, and where you will run into it.

Why Base64 Exists

Computers store everything as raw bytes — sequences of eight bits that can take any of 256 values. The problem is that many systems that move data around were designed for text, not arbitrary bytes. Email, URLs, JSON, XML, and many configuration formats expect printable characters, and they can mangle or reject bytes that happen to look like control characters, line breaks, or reserved symbols. Trying to stuff raw binary — an image, an encryption key, a compiled file — through such a channel often corrupts it.

Base64 solves this by translating any binary data into a string made only of safe, printable characters that survive text-based systems intact. It is a transport encoding: a reversible way to carry binary data through channels that only reliably handle text. The receiver decodes the Base64 back into the exact original bytes. Nothing is lost, and nothing about the data's meaning changes — only its representation.

How the Encoding Works

The mechanism is elegant once you see it. Base64 processes data in groups of three bytes. Three bytes are 24 bits, and 24 divides neatly into four groups of six bits. Each six-bit group can hold a value from 0 to 63, and Base64 maps those 64 possible values to a fixed alphabet of printable characters: the uppercase letters A–Z, the lowercase a–z, the digits 0–9, and the two symbols + and / — 64 characters in total, which is where the name comes from. So every three bytes of input become four Base64 characters of output.

Because four characters represent three bytes, Base64 output is about 33% larger than the original data — the price of text safety. When the input length is not an exact multiple of three, the encoder pads the final group with = characters so the output stays a multiple of four: one = means the last group held two bytes, two == means it held one. That padding is what lets a decoder know precisely where the original data ended, which is why you so often see a Base64 string finish with one or two equals signs.

Standard Base64 vs Base64url

Two of the standard Base64 characters — + and / — are problematic in some contexts. In a URL, / is a path separator and + can mean a space, so a Base64 string dropped into a URL or filename can be misinterpreted or require awkward percent-encoding. To fix this, a variant called Base64url replaces + with - and / with _, producing output that is safe to use directly in URLs and file names.

Base64url is what you find inside JWTs and many other web standards. This is why, to read a JWT payload in a standard decoder, you sometimes convert the URL-safe characters back first — swapping - for + and _ for /. A good decoder handles both variants, so in practice you can usually paste either form and get the right result.

A Crucial Warning: Base64 Is Not Encryption

This is the single most important thing to understand about Base64, and getting it wrong has caused real security incidents. Base64 provides no security whatsoever. It is not encryption, not hashing, and not obfuscation in any meaningful sense. Anyone can decode a Base64 string back to its original content instantly, with no key and no password — which is exactly what this tool does. The encoding is completely reversible by design.

The practical consequence: never rely on Base64 to protect sensitive data. A password, API key, or token that is “only Base64-encoded” is effectively stored in plain text to anyone who looks. When you see credentials in Base64 — in a config file, an HTTP Basic Auth header, or a Kubernetes secret — understand that the encoding is there for transport safety, not confidentiality. If you genuinely need to protect data, use real encryption such as AES-256. Base64 and encryption solve entirely different problems.

Decoding Text vs Binary

One common surprise when decoding is getting garbled, unreadable output. This is not an error — it means the Base64 encoded binary data, such as an image, a PDF, or an executable, rather than text. The decoder correctly recovers the original bytes, but a text display cannot render arbitrary binary as readable characters, so you see gibberish. If you know a Base64 string represents a file, decode it with a tool that offers a file download rather than a text view, so the recovered bytes are saved intact. When the encoded content genuinely is text — a JWT payload, a JSON blob, a username — the decoded output will read cleanly, which is exactly the case this decoder is built for.