Base64 → bytes
Base64 to Hex Converter
Unpack Base64 back into hexadecimal bytes, with the decoded text shown alongside.
—
—
—
What decoding gives you
Base64 is compact but opaque. You cannot see where one byte ends and the next begins, so a payload that is obviously wrong stays obviously wrong without telling you why. Converting to hex restores the byte boundaries, and once they are visible the structure usually is too.
This converter shows three views at once: the hex bytes, their decimal values, and the result of decoding those bytes as UTF-8 text. If the payload is text, the third view answers your question immediately. If it is not, the first two show you what it actually is.
How the unpacking works
- Take the Base64 characters four at a time.
- Map each to its six-bit value using the alphabet: A–Z is 0–25, a–z is 26–51, 0–9 is 52–61, then + is 62 and / is 63.
- Join the four six-bit values into 24 bits.
- Re-slice those 24 bits into three bytes of eight.
- Write each byte as two hex digits.
Worked example
SGVs S → 18 → 010010 G → 6 → 000110 V → 21 → 010101 s → 44 → 101100 join 010010000110010101101100 reslice 01001000 01100101 01101100 bytes 48 65 6C result → 48656C — which is "Hel" in ASCII
Input this converter handles
Base64 in the wild is inconsistent. All of the following are accepted and normalised before decoding.
- Missing padding. Many systems strip trailing
=characters. They are restored automatically. - URL-safe alphabet.
-and_are translated back to+and/, so JWT segments decode directly. - Line breaks. MIME wraps Base64 at 76 characters. Whitespace is removed.
Anything genuinely outside the alphabet is reported rather than skipped, because a stray character usually means the value was truncated or mis-copied.
Reading the first bytes
Once you have hex, the opening bytes often identify the payload outright. File formats begin with a signature, and Base64 preserves it.
| First hex bytes | Base64 begins | Format |
|---|---|---|
| 89 50 4E 47 | iVBORw0K | PNG image |
| FF D8 FF | /9j/ | JPEG image |
| 25 50 44 46 | JVBERi0 | PDF document |
| 50 4B 03 04 | UEsDB | ZIP archive, or docx/xlsx |
| 1F 8B | H4sI | gzip compressed data |
| 7B 22 | eyJ | JSON starting with a quoted key |
The last row is the one you will meet most often. A JWT's payload segment nearly always starts
eyJ, because every JWT payload is JSON beginning with {".
Base64 is not encryption
It is worth stating plainly, because the mistake is common and costly. Base64 has no key and no secret. Anyone who sees the string can decode it in one step, exactly as this page just did. A token that is merely Base64-encoded is a token in plain sight — the signature on a JWT proves who issued it, but the payload is readable by anyone holding the token.
Frequently asked questions
How do I convert Base64 to hex?
Map each Base64 character to its six-bit value, join them four at a time into 24 bits, then re-slice into three bytes and write each as two hex digits.
My Base64 has no equals signs at the end. Is it broken?
No. Many systems strip the padding. It is restored automatically before decoding.
What are the dashes and underscores in my token?
The URL-safe Base64 alphabet, which replaces + and / so the value can appear in a URL. JWTs use it. Both variants are accepted here.
Why does my Base64 decode to unreadable characters?
Because it is not text. It may be an image, compressed data or a binary structure. The hex view will usually identify it from the first few bytes.
Is Base64 secure?
No. It is a reversible encoding with no key. It hides nothing from anyone who has the string.
What does a JWT starting with eyJ mean?
That the segment decodes to JSON. Every JWT payload begins with an opening brace and a quote, which always encodes to eyJ.