Fix "Invalid Base64 character"

What the error means

Base64 maps every 6 bits of data onto one of 64 characters. The standard alphabet is A–Z, a–z, 0–9, +, and /, with = for padding. Invalid Base64 character means the decoder found a character outside the alphabet it was told to use. The character is usually named in the message, and its position tells you what kind of problem you have.

The example contains - and _. Those are the two characters that the URL-safe variant substitutes for + and /, precisely so that a token can travel in a URL without being mangled. Decoded in standard mode, they are simply invalid.

Why it happens

• URL-safe Base64 decoded as standard. JWTs, OAuth tokens, and most API keys use the URL-safe alphabet (- and _). Decoding them in standard mode fails on the first such character.
• Line breaks and spaces. MIME-encoded email bodies and PEM files wrap Base64 at 64 or 76 columns; a copy from a terminal or a chat wraps it too. Whitespace is not in the alphabet.
• URL-encoding. A value that passed through a query string may contain %2B for +, %2F for /, and %3D for =.
• A data-URI prefix left on the text: data:image/png;base64, before the payload.
• Typographic characters from a document: – instead of -, or a non-breaking space.

How to fix it

1. Paste the text into the tool above in decode mode. The error names the character and its position.
2. If the character is - or _, switch to URL-safe mode and decode again; nothing else needs to change.
3. If it is a space or a newline, remove all whitespace first — the tool can strip it, or a single search-and-replace in an editor does it.
4. If it is %, URL-decode the text first, then Base64-decode the result.
5. Remove any data:...;base64, prefix; only the part after the comma is Base64.

The example decodes in URL-safe mode to Hello world> from a JVT; in standard mode it fails at the -.

If it still fails

• An invisible character is the usual culprit when everything looks right. String Inspector lists every non-printing and confusable character with its index.
• If the text is a JWT, JWT Decoder handles the URL-safe alphabet and the three-part structure for you.
• Some encoders emit Base64 with a custom alphabet (bcrypt's ./A–Za–z0–9, for instance). Those are not Base64 in the standard sense and need the library that produced them.