Base64 Decode and Encode
Base64 decode and encode in your browser, with UTF-8 text read correctly, either alphabet accepted, and the exact character named when the input is not valid Base64.
Decoded text
- Size 26 Base64 characters carry 156 bits, and floor(156 / 8) = 19 whole bytes. The == at the end is padding and carries nothing.
- 19 bytes
- Text 19 bytes make 14 characters because UTF-8 uses two to four bytes for anything outside ASCII.
- valid UTF-8, 14 characters
- Alphabet The input has none of + / - _, so it reads the same in standard Base64 and base64url.
- either
- Padding Correct for the length: the last group of four needed it.
- == (2)
| Group | Bytes (hex) | Six-bit groups | Indexes | Base64 |
|---|---|---|---|---|
| 1 | 43 61 66 | 010000 110110 000101 100110 | 16, 54, 5, 38 | Q2Fm |
| 2 | C3 A9 20 | 110000 111010 100100 100000 | 48, 58, 36, 32 | w6kg |
| 3 | E2 98 95 | 111000 101001 100010 010101 | 56, 41, 34, 21 | 4piV |
| 4 | 20 66 6F | 001000 000110 011001 101111 | 8, 6, 25, 47 | IGZv |
| 5 | 72 20 E2 | 011100 100010 000011 100010 | 28, 34, 3, 34 | ciDi |
| 6 | 82 AC 33 | 100000 101010 110000 110011 | 32, 42, 48, 51 | gqwz |
How the Base64 Decode and Encode works
Base64 writes bytes as text, using 64 characters that survive any system built for text: email, JSON, URLs, HTML attributes. Decoding reverses it exactly. There is no key and no secret involved, so anyone can decode a Base64 string, and it hides nothing.
The method is a regrouping of bits. Three bytes are 24 bits, which cut into four groups of 6 bits. Each 6-bit group is a number from 0 to 63, and that number picks a character from the alphabet A-Z, a-z, 0-9, + and /. The word Man is the bytes 4D 61 6E, which regroup into 19, 22, 5 and 46, which are T, W, F and u: TWFu. Decoding runs the same steps backwards.
When the input is not a multiple of three bytes, the last group is short. One leftover byte becomes two characters and two = signs; two leftover bytes become three characters and one =. That padding is why a padded Base64 string is always a multiple of four characters long, and why n bytes encode to 4 x ceil(n / 3) characters: a third larger, plus up to two characters of padding. The example this decoder opens with is 28 characters, 26 of data and 2 of padding, and it decodes to 19 bytes.
Those 19 bytes are 14 characters of text, and the difference is where text and Base64 go wrong. Base64 encodes bytes, not letters, so text has to become bytes first, and on the web that means UTF-8: é takes two bytes, and ☕ and € take three each.
There are two alphabets. The standard one, RFC 4648 section 4, uses + and /, which mean something in a URL, so section 5 defines base64url with - and _ in their place, usually without the padding. JSON Web Tokens use it. A string that mixes the two alphabets is refused. MIME email (RFC 2045) wraps encoded lines at 76 characters, and line breaks and spaces are skipped when decoding.
Base64 Decode and Encode FAQ
How do I decode Base64?
Map each character back to its 6-bit value, join the bits, cut them into bytes, and read the bytes as UTF-8. Standard and URL-safe Base64 are both read, line breaks and spaces are skipped, and missing padding is fine. If the bytes are UTF-8 text you get the text; otherwise you get the bytes in hex, with the file type when it is recognizable.
Is Base64 encryption? Can it be decrypted?
No. Base64 is an encoding with no key, so decoding it is all the "decryption" there is, and anyone can do it. A password or token stored as Base64 is stored in the clear. Use real encryption, or a password hash, for anything secret.
Why does it say my Base64 is invalid?
There are four reasons and the error names which, with the position: a character outside the alphabet (often a quote or a period from copying too much), padding with more data after it, the wrong number of = signs for the length, or a length that leaves one character over after the groups of four, which usually means the string was cut short.
What do the = signs at the end mean?
Padding. Base64 works in groups of four characters for every three bytes, and when the data runs out partway through a group, = fills the rest. One leftover byte gives ==, two give =. The padding carries no data, which is why base64url can leave it off.
How much bigger does Base64 make data?
4 x ceil(n / 3) characters for n bytes, so about a third bigger. A megabyte of 1,000,000 bytes becomes 1,333,336 characters. MIME email adds a line break every 76 characters on top of that.
What is b64 decode?
The same thing: b64 is shorthand for Base64 (also written base 64), and Python's function is base64.b64decode. One difference worth knowing is that Python's version, by default, discards characters outside the alphabet before decoding unless you pass validate=True. This decoder reports them instead.
Can I decode a JWT with this?
One part at a time. A JSON Web Token is three base64url strings joined by periods: the first (the header) and the second (the payload) each decode to JSON. The third is a signature, which is binary and shows as hex. The whole token does not decode as one string, because a period is not a Base64 character.
Is what I paste sent anywhere?
No. The decoding runs in your browser, and nothing you type is sent to a server. That matters for Base64 more than most tools, because the strings people decode are often tokens and credentials.