Base64 Validator

Paste a string and this checks whether it's valid Base64 — the character set and variant (standard vs URL-safe), the padding, the length, and any invalid characters — and shows the decoded byte length. Everything runs in your browser — nothing is uploaded.

How to validate a Base64 string

Paste the string into the input above and the validator runs each check instantly and locally. It strips an optional data: prefix, then reports: the character set / variant (standard +/, URL-safe -_, or invalid characters), whether whitespace or newlines are present, whether the length is a multiple of 4, whether the padding is correct, and whether the string actually decodes — showing the decoded byte length when it does. Each line is a pass, a warning, or a failure, and an overall verdict sums it up: Valid, Valid with warnings, or Invalid.

Standard vs URL-safe

Base64 comes in two common alphabets. Standard Base64 uses A–Z, a–z, 0–9, and the two symbols + and /, padding the end with =. URL-safe Base64 (RFC 4648 §5) swaps + for - and / for _ so the string is safe to drop into a URL or filename, and it usually omits the = padding. A string that mixes the two, or contains any other symbol, isn't valid Base64. The validator detects which variant you have and flags any character that fits neither. For more, see Base64 URL-safe.

Padding and length rules

Base64 encodes 3 bytes into 4 characters, so a complete standard Base64 string's length is always a multiple of 4. When the input isn't a multiple of 3 bytes, the encoder pads the final group with =: one = when 2 bytes remain, two = when 1 byte remains, and never three. That means a valid standard string ends in zero, one, or two = and its total length divides by 4. URL-safe strings often drop the =, so their length may not be a multiple of 4 — that's expected, and the padding can be re-added to decode. A length that can't be reconciled even after padding, or the wrong number of =, means the string is malformed. See Invalid Base64 Padding for the details.

Is this private?

Yes. Every check runs fully in the browser with JavaScript — your string is inspected and test-decoded locally, and nothing is uploaded to any server. You can confirm in DevTools → Network: validating fires no request.

Frequently asked questions

How do I check if a string is valid Base64?

Paste it into the validator above. It checks the character set and variant (standard vs URL-safe), whether whitespace is present, whether the length is a multiple of 4, whether the padding is correct, and whether the string actually decodes — then shows the decoded byte length and an overall verdict.

What makes a Base64 string invalid?

A string is invalid Base64 if it contains characters outside the alphabet (letters, digits, + and /, or - and _ for URL-safe, plus = for padding), if its length after removing padding implies an impossible byte count, or if the padding is wrong. Whitespace and a missing final = are technically invalid but many decoders tolerate them.

What's the difference between standard and URL-safe Base64?

Standard Base64 uses + and / as its last two characters and pads with =. URL-safe Base64 replaces + with - and / with _ so the string is safe in URLs and filenames, and usually drops the = padding. This validator detects which variant your string uses.

Is the Base64 validator private?

Yes. Every check runs in your browser with JavaScript — your string is inspected and test-decoded locally, and nothing is uploaded to any server.