Skip to content

Base64 Decoder

Strictly decode standard or URL-safe Base64 into UTF-8 text, with explicit malformed-input errors and an untrusted-output security boundary.

Use this result well

Inputs that matter
Standard or URL-safe Base64, or a complete data URL with a Base64 or percent-encoded payload.
Output to expect
A UTF-8 text view and a decoded.bin download that preserves every decoded byte, including empty files, BOM and original line endings.
How it works
Raw Base64 checks alphabet, complete or omitted padding and zero pad bits. Data URLs follow browser body-decoding rules: exclude the fragment, percent-decode once, then decode a final ;base64 payload with the standard alphabet.
  • The text view always uses UTF-8; a data URL charset declaration does not transcode the bytes. Binary or other encodings can still be downloaded.
  • Invalid encoding produces an error and no download. Text chains stop when bytes cannot be represented as UTF-8; use single Base64 decode for binary files.
  • Decoding does not decrypt a message or establish that its contents are trustworthy.
  • Text input is limited to 2,000,000 UTF-16 units and each result to 20,000,000. Large conversions can be cancelled or retried.

Choose your path

Built around the job you need to finish

Decode standard or URL-safe RFC 4648 Base64 or a complete data URL into original bytes, offer an exact decoded.bin download, and show valid UTF-8 as inert text with its BOM preserved. Raw Base64 requires canonical pad bits; data URL payloads follow browser decoding rules without charset transcoding.

API developer inspecting an encoded test field

Decode padded or unpadded standard/URL-safe Base64 without an auto-detect mode silently reversing the task.

Paste an authorized fixture, inspect strict errors and exact UTF-8 output, then save the three-field Project record.

The decoded text matches the producer bytes and the chosen Tool does not encode instead.

Security reviewer handling attacker-controlled content

Prevent decoded markup, script, credentials or binary bytes from being treated as safe or authenticated.

Use a redacted non-secret fixture, retain the visible trust boundary and review output only as inert text.

No decoding result is executed, navigated, rendered as markup or accepted as origin/integrity evidence.

International and assistive-technology tester

Verify CJK, accents and emoji while receiving explicit errors for non-UTF-8 bytes and malformed Base64.

Exercise both alphabets, padding and whitespace cases with labeled input/output/copy/save controls.

Can reproduce valid text and understand every rejection without relying on color.

Authoritative checks for this tool

Outputs and checklists are planning aids. Review the linked current authorities and the records, terms, instructions, and requirements that apply to your exact situation before a consequential decision.

Was this tool helpful?

Projects using Base64 Decoder

This tool is part of these guided projects. Each project provides step-by-step instructions with checklists and all the tools you need in one place.

Web App Security Review Record

Coordinate one authorized web-app security review from people, assets and threat boundaries through selected requirements, control evidence, safe testing, remediation, recovery, monitoring, and named risk acceptance.

6 steps13 toolsStart project

Related Tools

Tools you might need next

Base64 Encoder

Encode UTF-8 text with RFC 4648 standard or URL-safe Base64 and an explicit padding policy, with strict errors and no encryption claim.

Recommended next stepEncoding
URL Decoder

Decode one percent-encoded URI or form field component with explicit plus handling, strict malformed-input errors, and inert output.

Recommended next stepEncoding
HTML Entity Decoder

Decode HTML named and numeric character references with text, attribute-value or semicolon-required rules. Preview and copy one decoding layer.

Recommended next stepEncoding

Reference & details

How it works

RFC 4648 validation

Whitespace is removed, alphabet and padding positions are checked, standard and URL-safe symbols are normalized, and impossible modulo-four lengths are rejected.

Strict UTF-8 text decode

Decoded bytes pass through a fatal UTF-8 decoder. Re-encoding must reproduce the canonical unpadded input, preventing silent replacement or ambiguous text output.

Inert untrusted output

The result is placed in a read-only text control. It is not navigated, executed, rendered as HTML, authenticated, decrypted, or approved for another system.

Updated: August 2026

Example Scenarios

A developer decodes an authorized URL-safe, unpadded fixture and saves the exact input, UTF-8 output, and untrusted-data warning to the security review.

A reviewer confirms that invalid alphabet, padding, length, noncanonical text, and non-UTF-8 bytes fail rather than producing replacement characters.

A security reviewer decodes a synthetic markup-like value but keeps it inert and refuses to treat Base64 or the displayed result as trustworthy.

FAQ

The decoder accepts standard Base64 using + and / and URL-safe Base64 using - and _, with or without trailing padding. Whitespace is ignored before strict canonical validation.

This is a text decoder. The decoded bytes must form valid UTF-8 and re-encode canonically. Arbitrary binary, malformed padding, impossible lengths, and invalid UTF-8 fail explicitly.

No. Base64 provides no confidentiality, integrity, authentication, origin, malware, markup, or script guarantee. Output is displayed as inert text and still requires context-specific review.

No. Use synthetic, redacted, or explicitly authorized non-production fixtures. Local browser processing does not control clipboard history, extensions, screenshots, device policy, or surrounding systems.

This focused Tool produces UTF-8 text only. Binary payloads that are not valid UTF-8 need a binary-aware workflow with explicit file type, size, provenance, and content-safety controls.

About Base64 Decoder

Decode one authorized Base64 fixture as strict UTF-8 text. The focused route accepts both RFC 4648 alphabets and optional padding, but never treats decoded content as safe, authenticated, or secret.