Base64 to File

Decode a Base64 string back into a real downloadable file — free, instant, nothing uploaded

Paste Base64 or a Data URI

We Work Out What It Is, Then Hand You the File

Someone sends you a wall of characters with no explanation. Is it a PDF? A zip? You paste it into a decoder and get "invalid input" with no clue why. This Base64 to file tool reads the bytes and tells you.

No data: header needed. Paste, decode, download — with the right extension already applied.

How to Decode Base64 to a File

Paste the string. Bare Base64, a Data URI, or base64url all work.
Glance at the counter. It warns you if characters went missing.
Click Decode to File. The green bar names the format it found.
Read any warnings. A MIME mismatch usually means a bug upstream.
Click Save. The extension matches the detected type.

That counter earns its place. Most failures we see are truncation, not corruption — someone copied from a terminal that clipped the output.

Why Byte-Level Detection Beats Prefix Matching

Most decoders guess the format from the first few characters of the Base64 text. That works until two formats share an opening.

WebP, WAV, and AVI are all RIFF containers. Their first four bytes are identical, so their Base64 prefixes are identical too. A prefix matcher cannot separate them and will confidently hand you a .webp that is really an audio file.

We decode the first 64 bytes instead and read the actual header. For RIFF files the subtype sits at byte 8 — WEBP, WAVE, or AVI — which settles it.

The same trick separates the ZIP family. DOCX, XLSX, PPTX, EPUB and JAR are all ZIP archives, so we look for a word/ or xl/ marker inside the header to name them.

Honest limit: if that marker sits past the first 64 bytes, you get ZIP. Rename the file and it opens perfectly.

Turning Base64 to PDF and Other Documents

PDFs are what most people bring here. They start with %PDF, which encodes to JVBERi0, so identification is instant and certain.

If the download opens to a blank page, the string was double encoded. Someone encoded text that was already Base64. Run the result through again and the real PDF appears.

For Office documents, expect DOCX and XLSX to be recognised by their internal folder markers. Legacy .doc and .xls files use a different container entirely and are detected separately.

Going the other way? The file to Base64 encoder handles any type and fills in the MIME header for you.

Handling base64url From JWTs and URLs

Standard Base64 uses + and /. Both break inside a URL, so a variant called base64url swaps them for - and _ and usually drops the = padding.

You will meet it in JWTs, OAuth flows, and signed query strings. Paste one into a standard decoder and it fails with no useful message.

We detect the variant and swap the characters back before decoding, then say so in the result bar. It costs nothing and removes a genuinely confusing failure.

Decoding a whole token, though? Use the JWT decoder — it splits the three segments and formats the claims properly.

A Security Note Worth Reading

Base64 is a favourite technique for smuggling executables past email filters and content scanners. Attackers encode a payload, the filter sees harmless text, and the recipient decodes it themselves.

So treat a decoded file the way you would treat any unknown download. Never run a decoded executable from a string you did not create.

Your antivirus flagging a decoded file is doing its job, not misbehaving. We would investigate rather than override it.

On the privacy side, decoding runs entirely in your browser. Nothing is uploaded, so pasting a confidential document here is safe from our end.

When You Want Text or an Image Instead

Three sibling tools cover the cases this page is not built for:

Plain text with emoji or non-Latin scripts — the Base64 encoder and decoder.
An image you want to preview before saving — the Base64 image decoder.
Producing a Data URI for CSS or HTML — the image to Base64 tool.

This page exists for everything else: the documents, archives, fonts, and media that image-only converters refuse.

Frequently Asked Questions

How can you tell the file type when the string has no data: header?

We decode the first 64 bytes and read the real file header. Nearly every format starts with a fixed signature — PDF opens with %PDF, PNG with a specific eight-byte marker, ZIP with PK. Those bytes identify the file with no header needed.

Why is WebP so often mistaken for a WAV file by other tools?

Both are RIFF containers, so their first four bytes are identical and so is their Base64 prefix. Tools that prefix-match on the Base64 text cannot tell them apart. The real subtype sits at byte 8, which is why we decode before deciding.

My DOCX downloads as a ZIP. Is that a bug?

Not really — a DOCX is a ZIP archive with a specific folder layout inside. We look for a word/ marker in the header and label it DOCX when we find one. If the marker sits past the first 64 bytes, you get ZIP instead. Rename the extension and it opens fine.

My string has dashes and underscores. Will it still decode?

Yes, we detect that and swap them back automatically. It is base64url, the URL-safe variant used in JWTs and query strings, where plus and slash would break the URL. The tool tells you when it has made the swap.

What does the truncation warning actually mean?

Base64 always encodes in blocks of four characters, so a valid string length is divisible by four. When it is not, characters went missing — usually a terminal that clipped the output or a copy that stopped early.

My PDF downloads fine but opens as a blank page. Why?

Almost always double encoding. Someone Base64-encoded a string that was already Base64, so what you decoded is text, not a PDF. Run the output through the decoder a second time and you should get the real file.

Can I use this to read a JWT payload?

It will decode the segment, but you will get raw JSON rather than anything readable. A JWT is three base64url parts separated by dots, so paste them one at a time. Our JWT decoder does the whole token properly.

The downloaded file has the wrong extension. Can I fix it?

Just rename it — the bytes are correct either way. Extensions are only a hint to your operating system, not part of the file. This happens with formats that share a container, like the ZIP family.

My antivirus flagged the downloaded file. Should I worry?

Take it seriously. Base64 is a favourite way to smuggle executables past filters, so scanners are rightly suspicious of anything decoded this way. Never run a decoded executable from a string you did not create yourself.

Is there a size limit on what I can decode?

Browser memory is the only ceiling, but it arrives sooner than you expect. The string, the decoded bytes, and the download blob all sit in memory at once. Anything over about 50 MB is better handled server-side.

The Short Version

Paste, decode, save. Turning Base64 to file works here without a header, because we read the real bytes rather than guessing from the text.

Check the warnings before you blame the string. Truncation and double encoding explain nearly every failure.

Related Tools You Might Like

Case Converter

Convert text between UPPERCASE, lowercase, Title Case, and more

Password Generator

Generate secure, random passwords with custom options

Word Counter

Count words, characters, paragraphs, and reading time

Base64 Encoder & Decoder

Encode and decode Base64 for text, files, and images with Data URI output

File to Base64

Encode any file type to Base64 or a Data URI, with the MIME type filled in

Regex Tester

Test and validate regular expressions with live preview