QuickMergeBase64 Decoder
Decode Base64 to plain text, to hex, or to formatted JSON. UTF-8 is handled correctly, URL-safe input is accepted, and missing padding is restored. Everything happens in your browser.
How do I decode a Base64 string?
Decoding Base64 to text, hex or JSON
Base64 turns arbitrary bytes into 64 printable characters so they can pass through channels built for text. Decoding reverses it. What you want out the other end depends on what went in, and the three modes here cover the cases that come up in practice.
Text, and the UTF-8 trap
Plain text is the common case, and it has one persistent problem. JavaScript's built-in atob produces Latin-1, so every character above U+00FF comes back mangled — accented letters, CJK text and emoji all turn into mojibake. That is why a string that decodes perfectly in Python looks broken in a browser console. This page decodes the bytes and then interprets them as UTF-8, which is what almost everything actually produces, so the output matches what you would get from base64 -d at a shell.
Hex, for when it is not text at all
Decoding Base64 to hex is what you want when the payload is binary and you need to look at the bytes: checking a file signature, inspecting a protocol frame, comparing a key against a known value. The output is grouped sixteen bytes to a line, which is the layout every hex dump uses and the one that makes a signature at the start of the data easy to spot.
JSON, for tokens and API payloads
A great deal of Base64 in day-to-day work is a JSON object — the payload segment of a JWT, a config blob, an encoded webhook body. The JSON mode decodes and then formats it with indentation, so the shape is readable immediately. If it will not parse, you get the raw text and the parser's complaint rather than an empty box, which is usually enough to see what is wrong.
What this page is not for
If your string decodes to a file rather than to characters — a PNG, a JPEG, a PDF — Base64 to image is the page for it: it detects the type from the magic bytes and hands you the file. To go the other way, the Base64 encoder produces the string. And it is worth restating that Base64 is not encryption: it has no key and reverses in one call, so anything genuinely secret needs real encryption, not an encoding.
Next steps
Related tools
- decode it to a file instead — when the string is a PNG, JPEG or PDF rather than text.
- encode rather than decode — to produce a Base64 string in the first place.
- decode a URL instead — percent-encoding is a different scheme entirely.
What to do with the result
- format the decoded payload — when it turns out to be JSON.
Browse all developer utilities, or see every QuickMerge tool.
Frequently asked questions
Paste the string above and it decodes as you type. The bytes are interpreted as UTF-8, so accented characters, CJK text and emoji come through correctly rather than as the mojibake JavaScript's built-in atob produces.
Switch the output to Hex. The decoded bytes are shown two hex digits each, grouped sixteen to a line — the standard hex-dump layout, which makes a file signature at the start of the data easy to recognise.
Because it was decoded as Latin-1 rather than UTF-8 somewhere along the way — the classic symptom of JavaScript's atob, which cannot represent anything above U+00FF. This page decodes the bytes first and then reads them as UTF-8, which is what almost everything produces.
Yes. Paste the middle segment and choose JSON — it is URL-safe Base64, which is accepted, and the padding is restored automatically. The result is formatted so the claims are readable. Note that decoding a JWT does not verify its signature; it only shows you what it says.
No, and treating it as such has disclosed a great many credentials. It is a reversible encoding with no key — decoding takes one function call and anyone can do it. Use it to move data through a text channel, never to conceal anything.
Base64 to image, which detects the file type from the decoded bytes and gives you the file with the right extension.
No. Decoding runs entirely in this browser tab. That is the point when the input is an API key, a token or a signed payload — pasting one of those into a server-side decoder gives it away.