Regex for Base64 Strings
Standard Base64 uses A–Z, a–z, 0–9, + and /, in blocks of four characters, with one or two = signs padding the final block. This pattern enforces all three rules, so a string with the wrong length or misplaced padding fails. It also accepts the empty string, which is valid Base64 for zero bytes.
/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/How it works, token by token
| Token | Meaning |
|---|---|
| ^(?:[A-Za-z0-9+/]{4})* | any number of complete four-character blocks |
| (?: | then, optionally, a final padded block: |
| [A-Za-z0-9+/]{2}== | two characters and two = signs (one leftover byte) |
| |[A-Za-z0-9+/]{3}= | or three characters and one = sign (two leftover bytes) |
| )?$ | end of string |
What it matches
SGVsbG8=SGVsbG8gd29ybGQ=QUJDYQ==SGVsbG8SGVsbG8===SGV$bG8=a=b=Try it live
One candidate per line — the m flag makes the ^ and $ anchors apply to each line. Edit anything; it runs in your browser.
Variations
^[A-Za-z0-9_-]+$Base64URL without padding, as used in JWTs (- and _ replace + and /)^(?=.)(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$the same as the main pattern, but rejects the empty stringLanguage notes
- MIME-encoded Base64 wraps lines at 76 characters. Remove whitespace before validating — in JavaScript, value.replace(/\s+/g, "").
Frequently asked questions
Does a match mean the string is Base64-encoded data?
Not necessarily. Plenty of ordinary words — 'test', 'abcd' — are valid Base64 by shape. A match tells you a decoder will accept the string, not that someone encoded it.
Why does a JWT segment fail this pattern?
JWTs use Base64URL: - and _ instead of + and /, and no padding. Use the Base64URL variation.
Building something custom? The regex tester gives you live match highlighting for any pattern.