Base64 Validator - Check and Repair a String

Paste a string and this page tells you whether it is valid Base64, and if not, exactly what is wrong with it. Checks run as you type.

It reports the character set, the length and padding, whether it uses the URL-safe alphabet, what file type the content looks like, and the decoded size. Anything fixable, it fixes and hands back.

What the Base64 Validator Checks

1. Character set - anything outside A-Z, a-z, 0-9, + and / is flagged and listed.
2. Length - a valid string never leaves a remainder of 1 when divided by 4.
3. Padding - counts the trailing = signs and says how many are missing.
4. Alphabet - spots base64url, which uses - and _.
5. Content - reads the file signature and names the format.

The Four Reasons a String Will Not Decode

After writing the decoders on this site, these are the failures that actually show up.

1. Truncation. The most common by far. Copying from a terminal, a log viewer or a database cell silently cuts the tail off. A length remainder of 1 proves it.
2. Stripped padding. Some encoders drop the trailing =. Harmless in itself, and most decoders cope, but strict ones refuse.
3. URL-safe alphabet. JWTs and query parameters use - and _. Feed that to a standard decoder and it rejects the characters.
4. Stray characters. A quote mark, a trailing comma, or a zero-width space pasted in from a document.

Reading the File Type From the First Characters

Every file format starts with a signature, and that signature survives encoding. So the head of the string tells you what is inside before you decode anything.

1. JVBERi0 - PDF
2. iVBORw0KGgo - PNG
3. /9j/ - JPEG
4. R0lGOD - GIF
5. UEsDBB - ZIP, or a docx or xlsx
6. eyJ - JSON, which usually means a JWT payload

Handy when someone hands you a blob with no context, and quicker than decoding it to find out.

Nothing You Paste Is Sent Anywhere

Every check here runs in your browser. The string never goes over the network.

That is the point for this tool in particular. The strings people need to debug are usually auth headers, tokens and API payloads, which is exactly the material you should not paste into a stranger's server.

Once the Base64 Validator Passes It

With a working string, take it to the right decoder: Base64 to text for readable content, Base64 to PDF for documents, or Base64 to image for pictures.