How do I decode a Base64 string safely?
You encountered a mysterious wall of letters ending with two equal signs (==) and you need to know if it is a JSON web token, an icon, or a secret message.
The short answer
In JavaScript use atob(encodedString), or Buffer.from(str, "base64").toString("utf-8") in Node. Or use the free decoder on this site, which never sends the string anywhere.
Step 1: Check the padding
Base64 strings come in blocks of 4 characters. If the length is not a multiple of 4, the encoder adds one or two equal signs (=) at the end.
Step 2: Watch out for non-ASCII text
atob() gives you one character per decoded byte, so multi-byte UTF-8 text comes back garbled. Feed those bytes through TextDecoder to get the original string.
Step 3: Inspect the payload format
Decoded payloads are frequently JSON data, URLs, or binary headers like data:image/png;base64,...
Common mistakes
- Confusing Base64 encoding with encryption. Base64 offers zero security and can be decoded by anyone in a fraction of a second.
- Forgetting URL-safe Base64 variants which replace + and / with - and _.