How to encode and decode Base64
Understand Base64 encoding, decode strings safely in the browser, and connect decoded output to JSON, JWT, and file workflows.
Maintained by Ali Aygör. Report a correction.
Choose encode or decode
Use Base64 Encode / Decode when you need to turn readable text into a Base64 string or inspect a Base64 value copied from an API, header, data URI, queue message, or fixture. Paste the value, choose the direction, and review the output before reusing it.
Encoding is not encryption. Anyone can decode Base64. Treat decoded secrets, tokens, certificates, customer IDs, and internal URLs as sensitive data even when the original value looked unreadable.
Validate what the decoded value contains
Decoded output may be plain text, JSON, a JWT segment, a URL, or a file payload. If it looks like JSON, open JSON Formatter. If it is part of a token, use JWT Decoder. If it represents a PDF, use Base64 to PDF to validate and preview the document.
When decoding fails, check for missing padding, copied whitespace, URL-safe Base64 characters, or prefixes such as data:application/pdf;base64,. Remove wrappers only when you know the receiving system expects the raw Base64 body.
Share results safely
For tickets and pull requests, share the decoded structure and the relevant field names instead of the full sensitive value. This keeps the workflow useful without creating security or AdSense policy risk.
Test UTF-8 and opaque data separately
A Base64 value represents bytes. Hello has a predictable text result; a file signature or encrypted payload may not be readable UTF-8. Do not conclude that every non-text result is a broken encoding.
SGVsbG8= → Hello
Base64URL uses - and _ instead of + and /
Encoding does not encrypt a secret or make it safe to share.Specifications and references
Continue the investigation
How to decode a JWT token
Learn how to decode JWT header and payload claims in the browser, read exp and iat values, and avoid common token mistakes.
Common JSON syntax errors and how to fix them
A practical guide to the JSON mistakes developers see most often: trailing commas, single quotes, comments, unescaped characters, and broken nesting.
Common JWT Security Mistakes Developers Should Avoid
A developer checklist for JWT algorithms, expiry, issuer, audience, signature verification, token storage, and safe debugging.
Related tools
Encoders & Decoders
OpenBase64 Encode / Decode
Encode plain text to Base64 or decode Base64 back to readable text with Unicode support.
API & Auth
OpenJWT Decoder
Decode JWT headers and payloads, inspect claims, and check expiry fields at a glance.
Formatters
OpenJSON Formatter
Pretty-print raw JSON, minify payloads, and inspect syntax errors with clear feedback.
Encoders & Decoders
OpenBase64 to PDF
Paste Base64 PDF data, validate it, preview it in the browser, and download the file.
Related workflows
Encoder and Decoder Tools
Encode, decode, escape, and unescape common values found in APIs, logs, URLs, and documents.
JWT Tools
Inspect JWT header and payload claims, check token times, and debug auth failures faster.
API Debugging Tools
Inspect the pieces that usually explain API failures: JSON, JWTs, headers, query params, cURL, and status codes.
JSON Tools
Format, validate, convert, and inspect JSON payloads without setting up a scratch project.