Decode Base64 strings to reveal hidden file types. Detect embedded images, scripts, and binary data in encoded strings.
This tool decodes a pasted base64 string back to raw bytes in the browser, then compares the leading bytes against a table of known file signatures (magic numbers) to report what the data actually is - PNG, JPEG, ZIP, PDF, ELF, a script shebang, and so on - regardless of what a filename or context claims. The most common surprise is a false negative: plain text, CSV, JSON, and many custom or encrypted containers have no magic number at all, so 'no file type detected' means the signature table found nothing, not that the string is fake or corrupt.
A concrete input and expected output from the current implementation.
Input
iVBORw0KGgo=
Expected output
Decoded to 8 bytes: 89 50 4E 47 0D 0A 1A 0A. Matches the PNG signature - PNG image detected.
Those 8 bytes are the fixed PNG file signature defined by the PNG specification; base64-encoding them produces exactly this string, so any decoder that checks magic numbers reports PNG.
The input is stripped of whitespace and line breaks, then decoded using the standard base64 alphabet (falling back to URL-safe characters - and _ - if present) with padding handled automatically. The result is a raw byte array kept entirely client-side, which the rest of the tool inspects and can display as hex.
The first several bytes of the decoded output are compared against a built-in table of known file signatures (e.g. 89 50 4E 47 for PNG, FF D8 FF for JPEG, 50 4B 03 04 for ZIP-based formats, 25 50 44 46 for PDF). The longest matching signature determines the reported type; if nothing matches, the tool reports no known signature rather than guessing.
No. It only decodes the bytes and reports what it detects from the header; it does not render images, execute scripts, or open archives. That's intentional - showing you the file type without executing it is what makes it safe to check something you don't trust yet.
A data: URI prefix (e.g. data:image/png;base64,...) needs to be stripped before pasting, or the leading text will break the decode. Double-encoded base64 will decode once into what looks like more base64 text rather than binary - you'd need to run the output through the tool a second time yourself.
The example and behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.
Generate strong, random passwords with customizable length, character sets, and complexity requirements.
Analyze password strength with entropy scoring, crack-time estimates, and improvement suggestions.
Create cryptographically random strings for API keys, tokens, salts, and unique identifiers.
Create QR codes for URLs, text, Wi-Fi credentials, vCards, and more with customizable size and colors.
Scan and decode QR codes from uploaded images or your device camera to extract embedded data.
Compute MD5, SHA-1, SHA-256, and SHA-512 checksums to verify file integrity and detect tampering.