Base64 Validator

How to validate a Base64 string

1. Paste the string into Base64 to check. Line breaks, PEM armor and data: prefixes can stay in; they are reported as findings and the rest is still analyzed.
2. Read the verdict at the top. Each problem is listed with its position, for example “at line 3, column 17 (char 169)”.
3. Look at Your input, problems highlighted to see the offending characters marked in place.
4. Check Which Base64 variants does it satisfy? to learn whether it is valid as standard, unpadded, URL-safe, MIME or PEM Base64, and why not where it fails.
5. Press Fix it to switch to repair mode, which cleans the string up.

What the validator checks

• Characters outside the alphabet, shown with their Unicode code point so invisible ones such as a non-breaking space (U+00A0) or a zero-width space (U+200B) become visible.
• Mixed alphabets: + and / from standard Base64 together with - and _ from Base64URL in one string.
• = in the middle, which almost always means two encoded values were glued together.
• Impossible length: after removing padding, a length with remainder 1 when divided by 4 cannot come out of any encoder. A character is missing or extra.
• Padding: missing, too many, or not matching the data length.
• Non-canonical trailing bits in the last character (RFC 4648 §3.5).
• Whitespace and line wrapping: spaces and tabs, the line width, and whether lines end in CRLF, LF or a mix.

Details adds the length, length mod 4, padding state, alphabet, decoded size and the detected content type. The highlighted copy of the input is limited to the first 20,000 characters, but the analysis always covers the whole string.

Same string, different decoders

“Valid” depends on who is asking. These five strings were run through four common decoders (Python 3.13, Node.js 24, the WHATWG atob and GNU coreutils 9.7):

The dangerous cell is Node quietly returning Hello for the glued input and losing half the data with no error. This tool therefore reports every deviation, including ones your own decoder tolerates. The variant table then tells you which strict format the string satisfies.

Is a valid string really Base64?

abcd, test and 1234 are all valid Base64. Each decodes to three random-looking bytes. So the tool also answers Is this really Base64? with a score from 0 to 100 and the reasons behind it, each marked as pointing towards or away from Base64:

• for: correct padding, mixed upper and lower case with digits, high character variety, an eyJ start (Base64 for {", typical of JSON and JWTs), or bytes that decode to a known file type or readable text;
• against: only letters (could be a word), only hex digits (could be a hex string), only digits (probably a number), a single letter case, or a very short string.

Treat the score as a hint: it is a heuristic, and a short string can fool it either way.

Checking Base64 in code

The strictest practical test is a round trip: decode, re-encode and compare. It rejects whitespace, missing padding and non-canonical endings in one go.

import base64

def is_canonical_base64(s):
    try:
        return base64.b64encode(base64.b64decode(s, validate=True)).decode() == s
    except ValueError:
        return False

In Node.js the same idea is Buffer.from(s, "base64").toString("base64") === s. A regular expression such as ^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$ checks the alphabet and length, but it accepts SGVsbG9= and the empty string. For URL-safe strings, convert them first or use the matching alphabet; see Base64 vs Base64URL. Error messages from specific languages are collected in Base64 errors.

FAQ