How to Decode a Base64 Encoded String (Linux, JS, Python)

To decode a Base64 encoded string, paste it into our Base64 encode/decode tool and choose Decode. You get the original text back instantly, with full support for emoji and non-English characters, and URL-safe Base64 (with - and _) is accepted too. On the command line, echo 'aGVsbG8=' | base64 --decode prints hello.

Base64 is everywhere: email attachments, data URLs, API payloads, JWT tokens and config files. Here is what it is, how to decode it in each language, and what it is not.

What Base64 is

Base64 is a way to write any data, including binary data like images, using only 64 safe text characters: A–Z, a–z, 0–9, + and /, with = for padding. It exists because many systems (email, JSON, URLs, XML) were designed for text and can corrupt raw binary bytes.

How it works, briefly:

1. Take the data 3 bytes (24 bits) at a time.
2. Split those 24 bits into four 6-bit groups.
3. Map each 6-bit value (0–63) to one of the 64 characters.

So hello (5 bytes) becomes aGVsbG8=: 8 characters, with one = because 5 is not a multiple of 3.

Why Base64 ends with == and why it is bigger

• Every 3 bytes become 4 characters, so encoded data is about 33% larger.
• If the last group has only 1 or 2 bytes, == or = is added so the length is a multiple of 4.

URL-safe Base64

Standard Base64 uses + and /, which have special meaning in URLs. Base64url replaces them with - and _ and often drops the = padding. JWT tokens use this form. Our decoder accepts both.

Base64 is not encryption

This is the most important point. Base64 has no key and no secret. Anyone who sees a Base64 string can decode it in a second. It is encoding, like writing a word in a different alphabet, not locking it.

• A password stored as Base64 is effectively stored in plain text.
• An Authorization: Basic header is just username:password in Base64; it is only safe over HTTPS.
• A JWT's header and payload are Base64url-encoded JSON that anyone can read; the signature stops tampering, not reading.

To protect data, use real encryption. To store passwords, use a slow password hashing algorithm such as bcrypt or Argon2. To check a file has not changed, use a hash; see our guide on how to check the SHA-256 hash of a file.

How to decode Base64 in the Linux command line

• Decode a string: echo 'aGVsbG8=' | base64 --decode
• Encode a string: echo -n 'hello' | base64 (the -n stops echo adding a newline, which would change the result)
• Decode a file: base64 --decode encoded.txt > original.bin
• Encode a file: base64 photo.jpg > photo.txt

On Linux, -d is the short form of --decode. On macOS, --decode works too (older versions use -D as the short form). GNU base64 wraps encoded output at 76 characters by default; add -w 0 on Linux for one long line.

How to decode Base64 in PowerShell

Decode to text:

[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aGVsbG8='))

Encode text:

[Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes('hello'))

Windows also has certutil -decode encoded.txt output.bin for files.

Base64 in JavaScript: atob and btoa

• btoa('hello') gives aGVsbG8=
• atob('aGVsbG8=') gives hello

The catch: atob and btoa only handle characters with codes up to 255. btoa('नमस्ते') or any emoji throws an error. For real UTF-8 text, convert through bytes:

const encode = (s) => btoa(String.fromCharCode(...new TextEncoder().encode(s)));
const decode = (b) => new TextDecoder().decode(Uint8Array.from(atob(b), (c) => c.charCodeAt(0)));

This is exactly how our tool handles Unicode. In Node.js, use Buffer.from('hello').toString('base64') and Buffer.from('aGVsbG8=', 'base64').toString('utf8').

Base64 in Python

import base64
base64.b64encode('hello'.encode('utf-8')).decode()   # 'aGVsbG8='
base64.b64decode('aGVsbG8=').decode('utf-8')          # 'hello'

For URL-safe input, use base64.urlsafe_b64decode. If you get a padding error, the string has lost its = signs; add = until the length is a multiple of 4.

Base64 in Java

Base64.getDecoder().decode(s) and Base64.getEncoder().encodeToString(bytes) from java.util.Base64 (Java 8 and later). Use Base64.getUrlDecoder() for URL-safe strings, and new String(bytes, StandardCharsets.UTF_8) to turn decoded bytes into text.

Decoding Base64 images and files

If the decoded result is a jumble of strange symbols, the original was binary data, not text. Common signs:

• Starts with data:image/png;base64, or data:image/jpeg;base64,: it is an image. Paste it into image to Base64, which also turns Base64 back into an image you can download.
• Starts with iVBORw0KGgo: a PNG. /9j/: a JPEG. JVBERi0: a PDF. UEsDB: a ZIP (or a .docx/.xlsx).

For non-image binary data, decode to a file with the command line (base64 --decode in.txt > out.pdf) rather than as text.

Base64 vs URL encoding

They solve different problems. Base64 turns any bytes into text. URL encoding (percent-encoding, like %20) makes text safe to put inside a URL. A Base64 string placed in a URL may still need URL encoding because of +, / and =. Use URL encode/decode for that, and see our URL encoding guide.

Common mistakes

• Treating Base64 as security. It hides nothing.
• Encoding with echo without -n, which adds a newline and changes the output.
• Using atob/btoa on non-English text and getting an error or garbled characters.
• Stripping the = padding and then getting "incorrect padding" errors in strict decoders.
• Embedding big images as Base64 in web pages. The 33% size increase and lack of caching usually make pages slower. It suits only small icons.

Questions