Base64 Decoder

Base64 is an encoding, not encryption. There is no key: anything Base64-encoded is readable by anyone who notices what it is. That is worth stating plainly, because a surprising amount of software still treats a Base64 string as if the transformation hid something.

Both alphabets, either padding

Standard Base64's + and / and Base64URL's - and _ both decode, including a string that mixes them — values get re-encoded as they pass between systems, and rejecting one for an alphabet swap helps nobody. Trailing = is optional. Whitespace and line wrapping are stripped, so a PEM block or a folded mail header pastes straight in.

When the bytes are not text

UTF-8 decoding runs in strict mode. If the bytes are not valid UTF-8 — a compressed blob, an executable, a key — you get a hex dump with an ASCII gutter rather than a failed decode. The alternative, a lenient decode, returns a wall of replacement characters that looks like success and is not.

Errors name the character

A character outside both alphabets is reported with its position, and a length that cannot be Base64 at all — a final group of one character, which is six bits, too few for any whole byte — is reported as such rather than as a generic failure.

A JWT's middle segment is Base64URL. Paste one here and the claims come back as JSON — which is the whole point of the JWT Decoder's warning that a token is not encrypted. For the token as a whole, use that tool instead; it splits the segments and checks the claims for you.