JavaScript Base64 Extractor
Extract and decode Base64-like literals from JavaScript source
Input
Extraction Report
What Is the JavaScript Base64 Extractor?
This tool finds Base64-like string literals in JavaScript and decodes valid candidates into readable text. It helps when obfuscated scripts hide URLs, tokens, or payload fragments in encoded strings. A candidate is any quoted string, template literals included, that is at least twelve characters long, uses only the standard alphabet from RFC 4648, and has a length divisible by four.
Extraction runs client-side and does not execute JavaScript. For broader detection, use JavaScript Obfuscation Detector. For string escapes, use JavaScript String Decoder.
How to Use the Extractor
Paste Script
Paste JavaScript code or upload a file containing encoded string literals.
Review Decoded Candidates
The report lists each Base64 match, decoded text, and nearby source context. Every candidate goes through the browser's atob(), and one that decodes to non-printing control bytes is dropped, which keeps most random IDs and binary blobs out of the list.
Copy or Download Report
Export findings for debugging, security review, or reverse engineering notes. If a decoded value turns out to be a live credential, assume it has leaked and rotate it; the OWASP Secrets Management Cheat Sheet covers how.
Example Extraction
Input
Output