This tool decodes Base64 and JWT tokens locally in your browser. It first detects the most likely format (Base64, Base64URL, Data URI, JWT, URL, or JSON) and shows a confidence score, then decodes into either readable UTF-8 text or a safe bytes view (hex) when the output is binary.
Paste a Base64 string, Base64URL string, JWT token, or a full Data URI like
data:application/json;base64,....
Everything runs client-side: your content stays on your device.
+/ and optional = padding)-_, usually without padding)
Detection is hypothesis-based. The tool checks character alphabet, padding rules,
and impossible Base64 lengths (for example, length mod 4 = 1).
If confidence is low, it shows “maybe” and avoids auto-decoding.
This prevents misleading results when random text “looks like Base64” but isn’t.
Real-world strings are often broken by copy/paste, emails, or log formatting. Use transforms to normalize input before decoding:
= only when safe)
If the input has mixed alphabets (+/ together with -_),
decode is intentionally manual to avoid guessing.
Decoding produces raw bytes first. Then the tool evaluates whether the bytes look like valid UTF-8 text. If it’s likely text, you see readable output. If it looks binary, you see a hex preview instead.
.binIf the decoded text is JSON, the tool can pretty-print it and highlight JSON parsing problems. For JWT, it decodes header and payload (Base64URL) but does not verify the signature online.
alg and typ
Some Base64 payloads represent compressed data. If the decoded bytes have a gzip signature
(1F 8B), the tool can inflate gzip into text using
DecompressionStream("gzip") when your browser supports it.
If gzip inflate is unavailable, you can still download bytes and decompress elsewhere.
This is an online Base64/JWT decoder: no uploads, no link fetching, and no tracking. URL and “suspicious” flags are pattern-based hints only — not a security verdict.
Paste your Base64 string and click Decode. Use “Decode → Text (UTF-8)” or “Auto” to display readable output when the bytes look like text.
Common causes include missing padding, invalid characters, mixed Base64/Base64URL alphabet, or corrupted data. Try a different decode strategy (Base64/Base64URL/Normalize) and check the warnings.
Base64URL is URL-safe Base64. It replaces + and / with - and _, and often omits padding =.
It means the input contains both Base64 characters (+/) and Base64URL characters (-_). Auto-decode is blocked because it becomes unreliable—use a manual strategy.
Yes. It can decode the JWT header and payload locally, and it can also pretty-print JSON when the payload is JSON.
No. This tool does not verify signatures. It only decodes content for inspection (online).
Processing happens locally in your browser. Nothing is uploaded. Still, don’t share secrets publicly—treat tokens as sensitive.
A Data URI embeds data directly in a URL-like string. Use “Extract Data URI payload” to pull out the Base64 part, then decode it.
Bytes view shows decoded data as hex. This is useful when the decoded output is binary (files, compressed data, encrypted blobs).
It means the decoded bytes don’t look like valid UTF-8 text (lots of control bytes or replacement characters). The tool shows hex preview by default to avoid misleading garbage text.
If gzip is detected (signature 1F 8B), click “Inflate gzip → text”. It works only in browsers that support DecompressionStream.
Either the decoded bytes are not gzip, or your browser doesn’t support gzip decompression APIs in the current environment.
Yes. Choose “Decode → Download .bin” or click “Download bytes (.bin)” after decoding to save the raw output.
It flags suspicious patterns (punycode domains, userinfo tricks, redirect-like parameters) but it does not provide a security verdict.
It’s a heuristic estimate of how likely the input matches a format. If it’s below the “maybe” threshold, the tool intentionally avoids pretending it’s certain.
Auto-decode is intentionally strict to prevent false positives and garbage output. Use the Decode button when you want best-effort decoding.
For standard Base64, use “Fix padding (=) for Base64”. For Base64URL, use “Add padding for Base64URL”.
It decodes bytes and re-encodes them into standard Base64. This helps normalize messy inputs into a consistent canonical Base64 string.
No. It runs locally in your browser. There are no uploads and no tracking in the tool logic.
Official specification for Base64 and Base64URL encoding rules, padding behavior, and character alphabets.
Official JWT specification describing header, payload, claims, and signature structure.
Browser-native Base64 encode/decode functions used in client-side JavaScript.
Web API reference for in-browser gzip decompression, used when inflating compressed Base64 payloads.
ClearExplained — simple pages that reduce mistakes.