What decoding does
Base64 decode maps four ASCII characters back to three bytes, then those bytes are shown as text (UTF-8). ToolPin does this in your browser. Nothing is uploaded. The tool is free and needs no account. If the bytes are not valid UTF-8, you may see replacement characters — the data might be a file, not a sentence.
Decoding is not “breaking” encryption, hashing, or password storage. Encrypted blobs that happen to be Base64-wrapped still need the key. MD5 and SHA-256 hashes are not Base64 of the password; they are one-way digests (and MD5 must not be used for passwords anyway).
Prefixes, whitespace, and alphabets
Data URLs look like data:text/plain;base64,SGVsbG8=. The decoder wants SGVsbG8=, not the data: prefix. JWT parts use URL-safe Base64 without padding; a standard decoder may fail on - and _ or missing =. Replace - with +, _ with /, and add padding to a multiple of 4 if you are unwrapping a JWT payload by hand. This page targets classic Base64 unless the UI states URL-safe support.
Whitespace and line breaks in MIME-wrapped strings should be ignored by a tolerant decoder. If yours is strict, delete newlines first.
Invalid characters (!, unicode quotes copied from Slack) cause failure. Re-copy the string from source.
Padding
Base64 length should be a multiple of 4. Missing = padding is common. Adding = until the length is divisible by 4 often fixes it. Extra characters at the end usually mean a copy-paste included a trailing quote.
Privacy and safety
You might decode something that contains a secret. Because the tool is local, ToolPin never sees it. You still should not paste other people’s credentials into a shared screen.
Do not decode untrusted Base64 and then execute it as HTML or a script. Treat the output like any untrusted text.
After you decode
If the result looks like JSON, run JSON Formatter. If it looks like a URL, you are done. If it looks like binary noise, it was probably an image or protobuf — save those bytes with a file-oriented tool, not a text box.
To go the other way, use Base64 Encode. Round-trip only holds for the same alphabet and UTF-8 text.
Common payloads you will see
API logs often Base64-wrap small JSON blobs. Decode, then run JSON Formatter. Email MIME parts may include line-wrapped Base64; strip whitespace if the decoder is strict. Browser data URLs mix a media type with a payload — only the part after the comma is Base64. None of these are encrypted. If the decoded bytes look like a ZIP or PNG header, save them as a file instead of reading them as a paragraph.
ToolPin never logs the string. Treat the output like the original secret if the payload contained one.