What the error means
Decoding Base64 has two steps. First the characters become bytes; that part succeeded. Then, to show you text, the bytes are interpreted as UTF-8. URI malformed is the message JavaScript's decodeURIComponent throws when a byte sequence is not valid UTF-8, and it surfaces here because that function is the usual way to turn decoded bytes into a string. In short: the data is fine, but it is not text.
The example is the first few dozen bytes of a JPEG file. /9j/4AAQSkZJRg is the Base64 spelling of the JPEG signature and the JFIF marker, and no image's bytes form valid UTF-8.
Why it happens
- The payload is binary. Images, PDFs, ZIP archives, protobuf messages, and encrypted blobs are routinely Base64-encoded for transport. They decode to bytes, never to text.
- The text is in another encoding. Latin-1, Windows-1252, Shift JIS, and UTF-16 all produce byte sequences that UTF-8 rejects. An
éin Latin-1 is a single byte0xE9, which on its own is invalid UTF-8. - Compressed text. Gzip or deflate output is binary even when the original was plain text.
- A truncated multi-byte character. Valid UTF-8 cut off in the middle of a 3- or 4-byte sequence fails at the boundary.
How to fix it
- Decode to hex with Text to Hex or look at the first bytes in the tool above.
FF D8 FFis JPEG,89 50 4E 47is PNG,25 50 44 46is PDF,1F 8Bis gzip,50 4Bis ZIP. A recognisable signature means you should not be decoding to text at all. - For an image, use Base64 Image Converter, which renders the bytes as a picture and offers a download.
- For text in a legacy encoding, decode to bytes and convert from that encoding (
TextDecoder("windows-1252")in JavaScript,.decode("latin-1")in Python) rather than assuming UTF-8. - For compressed data, decompress first, then decode the text.
If it still fails
- If only the end of the output is affected, the input was truncated mid-character. Check the source length.
decodeURIComponentthrows the sameURI malformedfor a%sequence that is not valid percent-encoding, which is a different problem with the same name; if the input was a URL rather than Base64, look for a stray%.- Nothing pasted here leaves your browser, so a payload from a production message queue can be inspected safely.
Related errors
Invalid Base64 character
Switch to URL-safe mode for tokens containing - or _, strip line breaks and spaces, and URL-decode text that contains %2B or %2F before decoding.
Incorrect padding
Append = until the length is a multiple of 4, or enable padding repair. If the text came from a JWT or a URL, decode it as URL-safe Base64, which omits padding by design.