> base64 | pdf | preview <
// Decode a Base64 string to a PDF document and preview it instantly
Inline PDF Preview
Renders the decoded PDF in a sandboxed iframe so you can verify content before saving — no download required for visual inspection.
Magic Header Check
Validates the leading %PDF signature (bytes 25 50 44 46) and surfaces a clear error if the input is not a real PDF — catches truncated or wrong-type Base64 instantly.
One-Click Download
Save the decoded result as document.pdf with a single click. The Blob URL is generated entirely in-browser — no server round-trip.
// ABOUT BASE64 PDFS
How It Works:
Base64 turns binary into ASCII so PDFs can travel through JSON, email, and APIs. We strip any data:application/pdf;base64, prefix, atob() the payload into a Uint8Array, validate the first four bytes match the %PDF magic (25 50 44 46), wrap the buffer in a Blob with type application/pdf, and feed the resulting object URL to an iframe and a download anchor.
Example:
data:application/pdf;base64,JVBERi0xLjQKJYCBgoMK…
Standards:
- >RFC 4648: The Base16, Base32, and Base64 Data Encodings
- >ISO 32000-1 / ISO 32000-2: Portable Document Format
- >PDF magic bytes: 25 50 44 46 (ASCII '%PDF') in the first 4 bytes
- >RFC 2397: data: URL scheme (data:application/pdf;base64,...)
Common Use Cases:
- >Debug PDFs returned by serverless functions
- >Inspect documents embedded in JSON responses
- >Verify reports generated by reporting tools
- >Extract attachments from API payloads
- >Quickly preview PDFs without saving them first
>> frequently asked questions
Q: What format should the input be?
A: Either a raw Base64 payload (just the alphabet A-Z, a-z, 0-9, +, /, =) or a full Data URL like data:application/pdf;base64,JVBERi0… — the prefix is automatically detected and stripped. Whitespace, newlines, and tabs inside the payload are removed before decoding so multi-line clipboard content pastes cleanly without manual reformatting.
Q: My PDF preview is blank — what should I check?
A: Confirm the decoded bytes begin with %PDF (25 50 44 46 in hex). If the validator complains, the Base64 is probably truncated, padded incorrectly, or contains non-Base64 characters such as smart quotes from a copy-paste. Some servers also wrap PDFs in extra encoding layers like gzip or hex before Base64; you would need to peel those layers first before this decoder will accept the input.
Q: Are uploads sent to a server?
A: No. Decoding, magic-byte validation, and the iframe URL are all created locally with atob and URL.createObjectURL. Nothing is sent over the network at any point — you can disable your connection and the decoder still works. This makes the tool safe for confidential documents that must never leave your machine.
Q: Why does the iframe use sandbox="allow-same-origin"?
A: The sandbox attribute disables scripts and form submission inside the PDF preview while still letting the browser fetch the Blob URL. This is a defense-in-depth measure when previewing untrusted documents — even if a malicious PDF tries to execute embedded JavaScript, the sandbox prevents it from accessing the parent page or making network calls.
Q: Is there a size limit?
A: Browsers can typically handle several megabytes without trouble. Very large PDFs (over ~50 MB) may be slow to decode because atob is synchronous and locks the main thread for the duration of the conversion. For huge documents, prefer downloading and opening with a native PDF viewer rather than decoding inline in a browser tab.
Q: What are the magic bytes %PDF for?
A: Every conforming PDF (per ISO 32000-1) starts with the byte sequence 25 50 44 46 (hex) — ASCII '%PDF' — followed by a version comment such as %PDF-1.4 or %PDF-2.0. Operating systems, browsers, and antivirus tools sniff these magic bytes to identify the file type independently of the .pdf extension. This decoder rejects any input whose decoded bytes do not start with that signature.