Base64 image data turns up in places it is awkward to get out of: an API response, a database column, a stylesheet, a JSON export, a saved HTML page, a webhook payload. This decodes it back into an actual image file you can open, edit or attach.
What it accepts
- A full data URI beginning
data:image/png;base64,— the prefix is stripped automatically. - A bare Base64 payload with no prefix at all.
- Strings with line breaks, spaces or indentation still in them, as happens when copying out of formatted JSON or a stylesheet.
- URL-safe Base64 using dashes and underscores instead of plus and slash, which some APIs use so the value survives being put in a URL.
The format is detected, not guessed from the prefix
Every image format begins with a distinctive signature — PNG starts with a specific eight-byte sequence, JPEG with FF D8 FF, GIF with the letters GIF8, WebP with RIFF followed by WEBP a few bytes later. This tool decodes the data first and then reads those bytes to decide what the file actually is, so you get the correct extension even when the data URI prefix is missing, wrong or was invented by whatever produced the string.
When it fails, and what that means
Truncation is by far the most common problem. Base64 strings are long, and copying them out of a terminal, a log viewer or a spreadsheet cell frequently cuts them short or inserts an ellipsis in the middle. A truncated string often still decodes into bytes — it simply produces a broken or half-drawn image. If the result looks cut off halfway down, you are missing the end of the string rather than hitting a bug.
The other frequent cause is copying surrounding syntax with the value: JSON quotes, a trailing comma, CSS url() parentheses, or HTML attribute quotes. Any of those make the string invalid. Select only what sits between the delimiters.
Why the size looks wrong
The decoded file is about a quarter smaller than the text you pasted, which is expected: Base64 stores three bytes of data as four text characters, so removing the encoding removes that overhead. A 400 KB string producing a 300 KB image is the encoding coming off, not data being lost.
Privacy
Decoding happens entirely in this tab. Nothing you paste is transmitted anywhere, which is worth knowing given that Base64 blobs pulled out of API responses and databases are frequently identity documents, signatures, medical scans and other things that should not be pasted into someone else’s server.