Stay organized with collections
Save and categorize content based on your preferences.
strings.base64_decode
strings.base64_decode(encodedString)
Description
Returns a string containing the base64 decoded version of the encoded string.
This function takes one base64 encoded string as an argument. If encodedString
is not a valid base64 encoded string, the function returns encodedString unchanged.
Param data types
STRING
Return type
STRING
Code samples
Example 1
"test" = strings.base64_decode($e.principal.domain.name)
Except as otherwise noted, the content of this page is licensed under the Creative Commons Attribution 4.0 License, and code samples are licensed under the Apache 2.0 License. For details, see the Google Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.
Last updated 2025-07-14 UTC.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-07-14 UTC."],[[["\u003cp\u003eThe \u003ccode\u003estrings.base64_decode\u003c/code\u003e function decodes a base64 encoded string.\u003c/p\u003e\n"],["\u003cp\u003eIt is supported in Rules and Search within Chronicle.\u003c/p\u003e\n"],["\u003cp\u003eThe function accepts a single \u003ccode\u003eSTRING\u003c/code\u003e argument that represents the base64 encoded string.\u003c/p\u003e\n"],["\u003cp\u003eIf the provided string is not a valid base64 string, the function returns the original string.\u003c/p\u003e\n"],["\u003cp\u003eThe function returns a \u003ccode\u003eSTRING\u003c/code\u003e that is the decoded version of the argument provided.\u003c/p\u003e\n"]]],[],null,["### strings.base64_decode\n\nSupported in: \n[Rules](/chronicle/docs/detection/default-rules) [Search](/chronicle/docs/investigation/udm-search) \n\n strings.base64_decode(encodedString)\n\n#### Description\n\nReturns a string containing the base64 decoded version of the encoded string.\n\nThis function takes one base64 encoded string as an argument. If `encodedString`\nis not a valid base64 encoded string, the function returns `encodedString` unchanged.\n\n#### Param data types\n\n`STRING`\n\n#### Return type\n\n`STRING`\n\n#### Code samples\n\n##### Example 1\n\n \"test\" = strings.base64_decode($e.principal.domain.name)"]]
