Decode Base64 into a file
Paste Base64 or a data URI and download the original file. The type is detected from the file signature, not from the string.
- Runs in your browser
- Nothing you enter is sent
- Free, no account
Nothing decoded yet. Paste a value above and the preview, detected type and download appear here.
Turning a string back into a file
Paste the value, check the detected type, name the file and download it. The decoder accepts
raw Base64, a full data: URI, the URL-safe alphabet, and input with line breaks or
spaces anywhere in it — all of which turn up when a value has been through a log, a YAML file
or a terminal.
Identifying what you have
The file type comes from the decoded bytes rather than from any label attached to the string. A few signatures worth recognising on sight:
| Decoded bytes begin | File | Note |
|---|---|---|
%PDF | Base64 starts JVBERi0 | |
PK 03 04 | ZIP | Also DOCX, XLSX, PPTX, JAR, APK, EPUB |
| 1F 8B | gzip | Often a .tar.gz |
-----BEGIN | PEM | Already text — it is Base64 inside a wrapper |
| 30 82 | DER | Binary ASN.1: a certificate or key |
00 01 00 00 / wOFF / wOF2 | Font | TTF, WOFF, WOFF2 |
PEM files are a special case
A .pem certificate or key is already Base64, wrapped in
-----BEGIN…----- lines. To decode one here, remove the header and footer lines and
paste only the body; what comes out is DER — binary ASN.1 — which is exactly what
openssl x509 -inform der expects. Keep the header if you want the PEM itself; it
is a text file already.
When the download will not open
- The string was cut short. Base64 length must divide by four after padding. A partial copy from a terminal that wrapped or a database viewer that truncated the column is the usual culprit.
- It is doubly encoded. If the decoded bytes are themselves printable Base64, run them through again.
- It was JSON-escaped. Sequences like
\/or\ninside the value mean it was serialised into a JSON string; unescape first. - Wrong alphabet. Values from JWTs use
-and_; we handle that automatically, but other tools may not.
A note on decoding things you were sent
A decoded attachment is a real file with real behaviour. Treat a Base64 blob from an email, a support ticket or a webhook exactly as you would treat an unexpected download: check the detected type here first, and open it somewhere you do not mind being wrong. Decoding is harmless; opening is not.
Everything happens in this tab
The bytes are reconstructed with atob, assembled into a Blob and
handed to the browser's download manager. No request leaves the page, which is what makes it
reasonable to decode a value copied straight out of production.
Questions
How does it know what kind of file this is?
It reads the magic bytes: %PDF for PDF, PK for ZIP and Office files, 89 50 4E 47 for PNG, ftyp for MP4. That beats trusting a data URI header, which is frequently wrong or missing.
The download opens as garbage. What went wrong?
Usually the string was truncated. Base64 length must be a multiple of four after padding — if the copy was cut short, the tail bytes are lost and the file will not parse. Re-copy the complete value.
Can I decode Base64 that came out of a JSON payload?
Yes. Strip the surrounding quotes and paste the value; escaped newlines and whitespace inside it are ignored, and URL-safe characters are handled.
Where does the downloaded file come from?
A Blob built in this tab and handed to the browser download manager. No request is made, which is why the tool still works with your Wi-Fi switched off.