Encode text or files to Base64 and decode back, with UTF-8 handling, validation, and size stats — fully local.
Processed locally in your browser
Processed locally in your browser — input is never uploaded, logged, or stored. Base64 is an encoding, not encryption.
The middle section of a JWT is Base64-encoded JSON. Decoding it here shows the payload — but this tool only decodes; it never verifies the signature. Decoded content is displayed without claiming any authenticity, which is why the page warns that decoding is not validation.
| Input | Value |
|---|---|
| base64 | eyJ1c2VyIjogImFsaWNlIiwgInJvbGUiOiAiYWRtaW4ifQ== |
| Result | {"user": "alice", "role": "admin"} (unverified — decoding is not authentication) |
base64 = 4 chars per 3 bytes, padded with "="
| Symbol | Meaning |
|---|---|
3 bytes | each 3-byte group becomes 4 base64 characters |
padding | "=" pads the final group to a multiple of 4 |
Text is encoded as UTF-8 bytes first — non-ASCII characters survive the round trip exactly.
output size ≈ input size × 4/3, rounded up to a multiple of 4
| Symbol | Meaning |
|---|---|
4/3 | the classic Base64 expansion factor |
Last reviewed August 4, 2026 · Version 1.0.0 · Toolivaro does not guarantee external content.
No. Base64 is an encoding that makes binary data text-safe; it adds no secrecy whatsoever. Anyone who sees the encoded text can decode it instantly. Never treat Base64 as a way to protect data.
Decoded bytes may not be valid UTF-8 — for example an encoded image or archive. The decoder detects this and offers the bytes as a downloadable file instead of corrupting them into text.
No. Any Base64 decoder can read a JWT payload; the signature is what proves authenticity, and verifying it requires the issuer’s key. A decoded token tells you nothing about whether it is genuine.
Found a mistake or have a correction? Report it — we review every correction.