Base64 to HTML

How to decode Base64 to HTML

1. Paste the Base64 into Base64 or data URI. A data:text/html;base64, URI works as well. For a large email body saved as text, use Open .txt file.
2. The info list shows the charset and the number of lines. Below it, a sandboxed frame shows the rendered page, with the note “Sandboxed preview: scripts, forms and external resources are blocked. The source is below.”
3. The Text pane under the preview holds the source. Copy text copies all of it.
4. Press Download file to save decoded.html.

Nothing is sent anywhere. The decoding happens in your browser, and the page may not make network requests other than Cloudflare’s page-view count.

Why the preview is sandboxed

HTML from an unknown source can do more than display text. An email body can carry a tracking pixel that reports when and where it was opened, a phishing page can contain a login form that posts to the attacker, and any page can run scripts. The preview blocks each of these:

The policy also blocks inline styles, so the preview shows the text, links and structure of the message more plainly than a mail client would. Images embedded as data: URIs are allowed and appear normally.

Pages larger than 2 MB are not previewed (“Too large to preview here. See the source below or download the file.”). The source pane shows the first 256 KB of any document; Copy text copies the full source of documents up to 8 MB.

Recognizing HTML in Base64

The charset is detected from the bytes: a byte order mark, UTF-16, valid UTF-8, or Windows-1252 as the fallback. A <meta charset> tag inside the document is not consulted, so a page in another legacy encoding can show wrong accents in the preview, while the downloaded file keeps its original bytes.

Where Base64 HTML comes from

In email, the HTML version of a message is often a MIME part with Content-Type: text/html and Content-Transfer-Encoding: base64. Paste just the encoded lines of that part here, or open the whole raw message in the EML decoder, which shows every part and attachment. Base64 in email explains the structure.

Some services that receive or render email deliver the HTML body as a Base64 field in webhook or API JSON, and template and PDF-rendering APIs sometimes return the generated HTML the same way. Decode Base64 inside JSON handles a whole payload at once.

Phishing campaigns use data:text/html URIs to carry a complete fake login page inside a link or attachment. Pasting the URI here shows the page without running it. For building such URIs, see HTML to Base64.

Preview untrusted HTML in your own app

The same approach works in any web page: decode, then put the result into an iframe with an empty sandbox attribute. The sandbox alone does not stop remote images and stylesheets from loading, so prepend a Content Security Policy for the frame:

function previewHtml(b64, container) {
  const bytes = Uint8Array.from(atob(b64), (c) => c.charCodeAt(0));
  const html = new TextDecoder().decode(bytes);
  const csp = `<meta http-equiv="Content-Security-Policy" content="default-src 'none'; img-src data:; style-src 'unsafe-inline'">`;
  const frame = document.createElement("iframe");
  frame.setAttribute("sandbox", "");
  frame.srcdoc = csp + html;
  container.append(frame);
}

In Chrome, a test page with a script, a remote stylesheet and a remote image ran no script and made no request with this function; without the <meta> line, the image and the stylesheet were fetched. Unlike the preview on this page, it keeps inline styles. More on Base64 in JavaScript.

FAQ