Base64 Decode
Paste a token, a data URI payload or a config value and read it — or type text and get the encoded form. Converts both ways as you type, handles UTF-8 and the URL-safe alphabet, and tells you what is wrong with a broken string instead of returning nonsense.
Free · No signup · Runs entirely in your browser
Type in either box and the other follows. Text goes through UTF-8, so emoji and non-Latin scripts work — the bare btoa() most tools ship throws on both. Nothing is uploaded; the conversion happens in this tab.
18 bytes of UTF-8
24 characters · +33% over the input
Standard alphabet with padding, per RFC 4648. Decoding accepts the URL-safe form too, so you can paste a JWT segment straight in.
Decoding a token by hand usually means something upstream is undocumented. Connect GitHub and Tekk turns what you want into specs your coding agent can actually execute against the real repo.
How base64 works
Three bytes of input become four characters of output. Each output character carries six bits, drawn from a 64-character alphabet: A–Z, a–z, 0–9, + and /.
When the input does not divide into three cleanly, the remainder is padded with =:
| Input | Bytes | Output |
|---|---|---|
f |
1 | Zg== |
fo |
2 | Zm8= |
foo |
3 | Zm9v |
foob |
4 | Zm9vYg== |
fooba |
5 | Zm9vYmE= |
foobar |
6 | Zm9vYmFy |
Those are the test vectors from RFC 4648 §10, and they are asserted against this tool's own solver — so what the page documents and what the box does cannot drift apart.
The UTF-8 problem
The implementation almost every online tool ships is one line:
btoa(text) // throws on anything above U+00FF
btoa maps each character to one byte, so it works for ASCII and Latin-1 and fails the moment you paste a name with a Cyrillic character, a Chinese string, or an emoji. Some tools throw a console error and show nothing; worse ones silently truncate.
The correct route encodes to UTF-8 bytes first:
const bytes = new TextEncoder().encode(text);
Decoding needs the mirror of that, with fatal: true so bytes that are not valid UTF-8 are reported rather than replaced with �. That distinction is why this tool can tell you "valid base64, but the 2 bytes it holds are not UTF-8 text" instead of showing you a row of question marks.
base64url, and why your JWT would not decode
+ and / both have meaning inside a URL. RFC 4648 §5 defines a variant that swaps them:
| Standard | URL-safe |
|---|---|
+ |
- |
/ |
_ |
= padding |
usually omitted |
A JWT is three of these segments joined by dots. Paste the middle one into a decoder that only knows the standard alphabet and it either errors or produces nonsense. Decoding here accepts both forms without being told which you have, and re-adds the missing padding.
The size cost
Base64 output is always 4/3 the size of its input, plus up to two padding characters:
output length = 4 × ceil(input bytes ÷ 3)
So roughly 33% larger. That is fine for a token in a header and expensive for a 400 KB image inlined as a data URI, where you pay the overhead on every page load and lose the ability to cache the asset separately.
When a string will not decode
There are only three ways base64 goes wrong, and the tool distinguishes them:
- A character outside the alphabet. Usually a stray quote from copying out of JSON, or a URL-safe
-in a decoder that does not expect one. The position is reported so you can find it. - A length that cannot be right. Valid base64 has a length that is a multiple of four once padding is accounted for. A remainder of one is impossible, so it means characters were lost in transit.
- Valid bytes that are not text. The decode succeeded; the content simply was not a string. Common with keys, images and compressed payloads.
How it works
- 1
Paste into either box
The two panels stay in sync. Put a string in the right-hand box to base64 decode it; type in the left to encode. There is no button and no request — the conversion happens in this tab, which matters when the thing you are decoding is a credential.
- 2
Turn on URL-safe if it came from a URL
JWT segments, query-string values and filenames use RFC 4648's URL-safe alphabet: hyphen and underscore instead of plus and slash, with the padding dropped. Decoding accepts either form automatically, so a base64 url encoder output pastes in without you needing to notice.
- 3
Read the error rather than the garbage
If a string will not decode, the tool says which character is wrong and where, or tells you the bytes are valid but not text. Most tools return replacement characters and leave you guessing whether the problem is the string or the encoding.
Frequently asked questions
- What is base64?
- A way of writing arbitrary bytes using only 64 characters that survive text-based transport: A–Z, a–z, 0–9, plus and slash. It exists because email headers, URLs and JSON are text channels, and raw bytes do not pass through them intact. It is an encoding, not encryption — anyone can reverse it.
- How do I base64 decode a string?
- Paste it into the right-hand box above and the decoded text appears on the left. If it came from a URL or a JWT it may use the URL-safe alphabet and have no padding; that is handled automatically, so there is nothing to convert first.
- How do I base64 encode text?
- Type it into the left-hand box and the encoded form appears on the right as you type. The text is converted to UTF-8 bytes first, so every character works — including the emoji and non-Latin scripts that make most online encoders throw.
- Why do other tools fail on emoji and accented characters?
- Because they use the browser's built-in btoa(), which only accepts characters up to U+00FF and throws on anything above. Encoding has to go through UTF-8 first. This tool does, which is why 世界 and 🚀 round-trip correctly here and break elsewhere.
- Is base64 encryption?
- No, and treating it as such is a real security mistake. Anything you base64 encode can be decoded by anyone, with no key, in a second. It is for safe transport of bytes through text channels — if the content needs protecting, it needs actual encryption underneath.
- What is the URL-safe alphabet?
- RFC 4648 §5 defines a variant where the 62nd character is a hyphen instead of a plus and the 63rd is an underscore instead of a slash, because plus and slash have meaning inside URLs. Padding is usually dropped too. A base64 url encoder produces this form, and it is what JWTs use.
- Why does base64 make things bigger?
- Because it packs 6 bits of data into each 8-bit character, so the output is 4/3 the size of the input — roughly 33% larger, plus padding. That is the cost of passing bytes through a text channel, and the reason inlining large images as data URIs is usually a mistake.
- What are the equals signs at the end?
- Padding. Base64 works in three-byte groups producing four characters; when the input does not divide evenly, one or two equals signs mark the shortfall. The URL-safe form typically omits them, and this tool re-adds them when decoding so a stripped string still works.
- Can I decode a JWT here?
- The payload, yes. A JWT is three base64url segments separated by dots — paste the middle one into the base64 decode box above and you will get the claims as JSON. Do not paste production tokens into any online tool as a habit; here the work happens in your browser, but that is not true of most sites offering the same thing.
- What does "valid base64 but not UTF-8 text" mean?
- That the string decoded cleanly into bytes, but those bytes are not readable text — usually because the original data was an image, a compressed blob or a binary key. The byte count is still shown, since that is often the useful part.
- Does it handle line breaks in the input?
- Yes. Base64 from a terminal, a PEM file or an email header is often wrapped at 64 or 76 characters. Whitespace and newlines are stripped before decoding, so you can paste straight from wherever you found it.
- Can I encode an image or a file?
- Not here — this is a text tool, and no file ever leaves your machine because none is accepted. For a data URI you would need the file's bytes rather than its name, which means a tool that reads files, and that is a meaningfully different privacy proposition.
- Do you store what I paste?
- No. The conversion runs entirely in your browser. Nothing is sent to a server, nothing is logged, and there is no account. Disconnect from the internet and it will still work — which is the property that matters when you are decoding a token.
- Why is this free, and what is Tekk?
- Tekk is a spec-driven development platform for people building software with AI coding agents. This tool costs us nothing to run, and the developers debugging an encoded value are the people we build for. No signup, no run limit, no upsell inside the tool.
Want a real spec for what you’re building?
Drop a sentence. Tekk grounds it in your actual code and turns it into an executable plan.
Free to try · Connect GitHub during signup