The string stays in the page
Decoding is atob and a typed array, both of which are local operations in the JavaScript engine. Nothing you paste is transmitted, logged or retained; close the tab and it is gone. Watch the network tab while you press Decode and you will see it stay quiet, or disconnect first and confirm the tool still works. This matters more here than for most utilities, because Base64 blobs pasted out of API responses and support tickets routinely contain someone's identity document or a screenshot of an internal system.
Format detection reads the bytes, not the label
A data URL announces its own type — data:image/png;base64, — and that announcement is frequently wrong, because whoever assembled it hardcoded a string. So the declared type is ignored in favour of the first few bytes of the decoded data, which every image format stamps with a fixed signature.
| Format | First bytes | As text |
|---|---|---|
| PNG | 89 50 4E 47 | .PNG |
| JPEG | FF D8 FF | — |
| GIF | 47 49 46 38 | GIF8 |
| WebP | 52 49 46 46 … 57 45 42 50 | RIFF…WEBP |
| BMP | 42 4D | BM |
| ICO | 00 00 01 00 | — |
| HEIC / AVIF | … 66 74 79 70 | ftyp at offset 4 |
| SVG | — | starts with <svg or <?xml |
When the label and the bytes disagree, the disagreement is reported and the download gets the extension the bytes justify. Saving a JPEG as .png works in most viewers, which is why the mismatch survives so long undetected, and fails in exactly the tools that check.
What breaks a paste
Whitespace and line breaks are stripped before decoding, so a string wrapped across eighty columns in a log file is fine. The URL-safe variant that uses - and _ in place of + and / is converted, and missing = padding is added back. What is not repaired is anything that is not Base64 at all: a leading or trailing quote from a JSON value, a fragment of src=" from an HTML copy, or a comma from a list. Those produce a specific complaint rather than a mystery failure.
Truncation is the failure that looks like something else. A string cut short can still decode — Base64 has no length field — and produce a file whose header is valid and whose body stops partway. The tell is a preview that renders the top of the image and turns grey or blank below the cut.
SVG deserves care
SVG is markup, and markup can carry script. This tool renders the decoded SVG in an <img> element, which is the safe context: browsers do not execute scripts inside an image-sourced SVG, and external references are blocked. Inlining that same SVG directly into a page with innerHTML is a different matter entirely, and unreviewed SVG from an untrusted source is a genuine injection vector. If you are about to paste a decoded SVG into a template, read it first.
Questions people ask
The preview is blank but the download works.
The signature was recognised, so the file is written correctly, but this browser declined to draw it. HEIC is the usual reason outside Safari, and AVIF on an older browser is the next. Save it and open it in something that handles the format. If the format is one browsers definitely support and it still will not draw, the data is damaged rather than exotic.
Half the image renders and the rest is grey.
That is truncation, and it is a property of the string you pasted rather than of the decoding. Image formats store scanlines in order, so a decoder draws everything up to the point the data stops and leaves the rest empty. Go back to the source, select the whole value, and check that the last characters you have match the last characters there.
Can it handle several images at once?
One at a time. Batch extraction from a JSON payload is a scripting job rather than a paste-box job — a few lines of Python or Node walking the structure and writing each field out with the extension its signature implies will be faster and repeatable, which matters if the payload arrives daily.
Why does my file come out slightly smaller than the source said?
It should not, and if it does the likely cause is padding. Every four Base64 characters decode to three bytes, so the decoded length is fixed by the string length and the number of trailing equals signs. A size mismatch of one or two bytes points at padding that was added or removed in transit; a larger mismatch points at truncation.