Why does my Base64 fail to decode?

Most often a length that is not a multiple of four, a character from the Base64URL alphabet (- and _) pasted into standard Base64, or invisible line breaks copied from an email. The error message says which one it is.

Should I include the == padding?

If the parser expects standard Base64, yes — many reject unpadded input. Some accept it either way, and Base64URL deliberately omits padding.

The decoded text looks like garbage. Why?

Either the payload is genuinely binary (an image, a compressed file) and should be saved rather than read as text, or it was encoded in a different character set than the one you are decoding with. Try Latin-1.

Is my data sent to your server?

No. Decoding runs entirely in the page, which is why pasting a production token here is safe in a way that pasting it into a random converter is not.

Text & Data Ready to use

Base64 Decoder

Decode Base64 back into readable text. Strips whitespace and data-URI prefixes, validates the alphabet and padding, and says exactly what is wrong.

Input

Operation

Character set

This tool runs entirely in your browser. Your input never leaves your device.

About Base64 Decoder

Decoding is where bad Base64 shows up, and the usual cause is not the alphabet — it is the baggage. Line breaks from a mail client, a leading 'data:image/png;base64,' someone forgot to remove, a stray space at the end of a copied token. This tool collapses whitespace and drops a data-URI prefix automatically, then validates what is left against the real rules.

The validation is specific because generic errors waste an afternoon. A character outside A-Z a-z 0-9 + / reports which alphabet problem you have; a length that is not a multiple of four tells you how many characters are missing; a string containing '-' or '_' is identified as Base64URL and not silently mangled into a wrong answer. UTF-8 is the default decode, so accented text and emoji come back as text rather than mojibake, with Latin-1 available for legacy byte-for-byte data.

All of it runs in your browser tab. That is the practical point when the encoded blob is a JWT payload, a config dump or anything from a production system — nothing about it leaves your machine.