Base64 is an encoding, not encryption. It replaces a byte sequence with characters that are convenient to transport through text-based systems. Decoding requires an alphabet and padding rules, not a secret key. If a token contains private data, wrapping it in Base64 does not protect that data.
First decision: text or bytes?
For a message, select UTF-8 text. The Lab converts the text into UTF-8 bytes and then Base64-encodes those bytes. For a file, select Binary file. The file’s original bytes are encoded directly, without treating them as text. Files are read in browser memory and are never uploaded.
Operation: Decode
Data type: UTF-8 text
Alphabet: Standard
Input: U2hpcCBpdCwgY2Fmw6kg4piV
Expected: Ship it, café ☕
Expected byte count: 18Valid Base64 does not promise valid text
The string /w== is valid standard Base64 for a single byte, hexadecimal ff. That byte is not valid UTF-8 by itself. In text mode the Lab reports an error rather than replacing it with a question mark or replacement character. Select binary mode to inspect or download the original byte.
Input: /w==
UTF-8 text result: invalid UTF-8 error
Binary result: ff
Downloaded bytes: one byte, 0xffStandard and URL-safe alphabets
Standard Base64 uses + and / and requires = padding where necessary to complete a group of four characters. URL-safe Base64 substitutes – and _; the Lab emits it without padding and accepts valid padded or unpadded input in that mode. Choose the alphabet explicitly instead of silently mixing them.
Bytes (hex): 00 01 02 03 fe ff
Standard: AAECA/7/
URL-safe: AAECA_7_ASCII whitespace is ignored during decoding. Invalid characters, misplaced padding, impossible lengths and nonzero unused trailing bits are rejected. For example, Zh== is rejected even though some permissive decoders turn it into the same byte as Zg==. Strict validation makes a mismatch explainable.
Use the result at the correct layer
A Base64 decoder cannot tell whether bytes are a PDF, an encrypted payload or an image. Binary previews show the first 256 bytes; the download contains all decoded bytes. The 2 MiB byte limit protects the local workspace from accidental oversized inputs. For actual confidentiality, use a suitable cryptographic design at the application boundary.