ValidateThis

Base64: invalid input error

“Base64: invalid input” means the string you tried to decode is not valid Base64: it contains characters outside the Base64 alphabet, has wrong padding, or uses the URL-safe variant where the standard one is expected.

Standard Base64 uses A–Z, a–z, 0–9, `+`, `/` and `=` padding. Anything else — spaces, newlines, quotes, or URL-safe `-`/`_` — makes strict decoders reject the input.

The value is often correct but wrapped: copied with surrounding quotes, split across lines by an email client, or prefixed with a data: URI.

Common causes

  • Characters outside A–Z, a–z, 0–9, +, / and = padding — often whitespace, line breaks, or quotes copied along with the value.
  • Wrong length: Base64 strings must be a multiple of 4 characters after padding.
  • URL-safe Base64 (- and _ instead of + and /) passed to a strict standard-Base64 decoder, or vice versa.
  • Data URI prefix (data:image/png;base64,) left in the string before decoding.
  • Double-encoded or truncated values from logs and JWT segments.

How to narrow it down

  • Check the length: valid padded Base64 is always a multiple of 4 characters.
  • Look at the first characters — `data:image/png;base64,` prefixes must be removed before decoding.
  • If the string contains `-` or `_`, it is URL-safe Base64 (JWT segments, URL tokens): convert or use a URL-safe decoder.

Examples

URL-safe value in a strict decoder (fails)
eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxIn0

JWT parts use URL-safe Base64 without padding. Replace - with +, _ with /, and add = padding — or decode each dot-separated part separately.

Fix padding
SGVsbG8 → SGVsbG8=

Length must be a multiple of 4; append = (one or two) to pad.

How to fix

  • Trim whitespace, line breaks, and surrounding quotes before decoding.
  • Add missing = padding so the length is a multiple of 4 (or use a decoder that tolerates missing padding).
  • Convert URL-safe characters: replace - with + and _ with / (JWT parts are URL-safe Base64 without padding).
  • Strip any data: URI prefix and decode only the part after base64,.
  • Paste the value into the Base64 tool below to decode it and pinpoint the first invalid character.

Watch out

  • Decoding the whole JWT at once always fails — the dots between segments are not Base64. Decode header and payload separately.
  • Whitespace inside the value (line wraps from terminals or emails) must be stripped, not just trimmed at the ends.

Related guides

Use our tool

Decode Base64

Advertisement

All guides