Find and Decode Base64 Inside JSON

How to decode Base64 fields in JSON

1. Paste JSON into Input · JSON, or drop a .json or .har file.
2. The table lists every match with its Path, what it Looks like, a confidence level and the Decoded preview, plus Copy decoded and Download.
3. The output pane holds the whole document with text, JSON and JWT values decoded in place, ready to read or diff.
4. Adjust Min length (default 8) to skip short strings, untick Parse nested JSON to stop at the first layer, or tick Show low-confidence matches when hunting for short binary keys.

The JSON to Base64 tab does the opposite: it validates JSON and encodes it as typed, minified or pretty, with URL-safe, no-padding and wrap options.

Example: an API response with three encoded fields

{
  "event": { "body": "eyJvcmRlcklkIjo0MiwicXR5IjoyfQ==", "isBase64Encoded": true },
  "file": { "name": "README.md", "encoding": "base64",
            "content": "IyBEZW1vCgpIZWxsbyBmcm9tIHRoZSBSRUFETUUuCg==" },
  "prefs": "eyJ0aGVtZSI6ImRhcmsifQ==",
  "sha": "3b18e512dba79e4c8300dd08aeb37f8e728b8dad"
}

$.sha is not listed. A 40-character hex string is valid Base64 by alphabet alone, but it is a Git hash, and the scanner rejects long hex strings on purpose. Every eyJ prefix in the table is the Base64 of {", a quick sign of encoded JSON.

Where Base64 hides in JSON

• AWS API Gateway and Lambda events carry binary or compressed bodies as body with "isBase64Encoded": true.
• GitHub’s contents API returns files as content with "encoding": "base64", broken into lines with \n. Line breaks are ignored here.
• Gmail API message parts use URL-safe Base64 in body.data. URL-safe input (- and _) is detected automatically.
• JWTs in access_token or id_token fields get header and payload decoded. For signature checks use the JWT decoder.
• Data URIs such as data:image/png;base64,… in avatar or logo fields are recognized with their MIME type.
• Kubernetes Secrets in JSON form; the Kubernetes Secret decoder adds Secret-specific features.

Doing it in Python

A minimal walker that reports strings decoding to UTF-8 text:

import base64, binascii, json, sys

def walk(node, path="$"):
    if isinstance(node, dict):
        for k, v in node.items():
            yield from walk(v, f"{path}.{k}")
    elif isinstance(node, list):
        for i, v in enumerate(node):
            yield from walk(v, f"{path}[{i}]")
    elif isinstance(node, str) and len(node) >= 8:
        try:
            text = base64.b64decode(node, validate=True).decode("utf-8")
            yield path, text
        except (binascii.Error, UnicodeDecodeError):
            pass

for path, text in walk(json.load(open(sys.argv[1]))):
    print(path, "=>", text[:60])

It misses URL-safe and unpadded values, and binary payloads such as images, which is where most of the work in a real scanner goes. See Base64 in Python for the decoding details and Base64 vs Base64URL for the alphabet difference.

Limits

• Detection is a heuristic. Values under 8 characters and random-looking binary keys may be missed or marked uncertain; lower Min length and enable low-confidence matches to see them.
• The scan stops after 200,000 strings and shows up to 1,000 rows, which covers large HAR files without freezing the tab.
• Invalid JSON is reported with line and column. For a single Base64 string that decodes to JSON, use Base64 to JSON.

FAQ