> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/convert_from_base_64.md).

# convert\_from\_base\_64

Use the `convert_from_base_64()` function to decode a base64-encoded input string and return it in its original, decoded string format.

## Syntax

```sql
convert_from_base_64 ("<base64-encoded input>")
```

## Parameters

| Name             | Type   | Required | Description                          |
| ---------------- | ------ | -------- | ------------------------------------ |
| `encoded_string` | string | Yes      | The base64-encoded string to decode. |

## Returns

The `convert_from_base_64()` function returns the decoded value as a string.

## Usage notes

* The function requires a single string input that is base64-encoded.
* The function consistently returns the decoded value as a string.
* The function is typically employed within the `alter` stage to create new fields or modify existing ones by decoding string data.
* The function can also be used within a `filter` stage if the decoding result is needed for a conditional check.

## Examples

### Example 1: Decoding a basic literal base64 string

**Goal**: Decode a common base64 string that represents "Hello world".

**XQL code**:

```sql
config timeframe = 1d 
| dataset = sample_xql_raw 
| alter decoded_string = convert_from_base_64("SGVsbG8gd29ybGQ=") 
| fields event_id, decoded_string 
| limit 3 
```

**Explanation**: This query adds a new field, `decoded_string`, which contains the plain text "Hello world" after decoding the provided base64 literal.

**Output**:

| EVENT\_ID | DECODED\_STRING |
| --------- | --------------- |
| 101       | "Hello world"   |
| 102       | "Hello world"   |
| 103       | "Hello world"   |

### Example 2: Decoding a literal base64 string representing JSON

**Goal**: Decode a base64 string that, when decoded, forms a JSON object. This shows the ability to handle more complex string content.

**XQL code**:

```sql
config timeframe = 1d 
| dataset = sample_xql_raw 
| alter decoded_json_string = convert_from_base_64("eyJsZXZlbCI6ICJpbmZvIiwgIm1lc3NhZ2UiOiAiU3lzdGVtIHN0YXJ0ZWQifQ==") 
| fields event_id, decoded_json_string 
| limit 3 
```

**Explanation**: The query decodes the base64 string, resulting in a JSON-formatted string as the value for `decoded_json_string`.

**Output**:

| EVENT\_ID | DECODED\_JSON\_STRING                            |
| --------- | ------------------------------------------------ |
| 101       | "{"level": "info", "message": "System started"}" |
| 102       | "{"level": "info", "message": "System started"}" |
| 103       | "{"level": "info", "message": "System started"}" |

### Example 3: Handling an invalid base64 input

**Goal**: Illustrate the function's behavior when provided with a string that is not a valid base64 encoding.

**XQL code**:

```sql
config timeframe = 1d 
| dataset = sample_xql_raw 
| alter invalid_decode_attempt = convert_from_base_64("NotABase64String!") 
| fields event_id, invalid_decode_attempt 
| limit 3 
```

**Explanation**: When the input string is not a valid base64 format, the `convert_from_base_64()` function still attempts to return the decoded string.

**Output**:

| EVENT\_ID | INVALID\_DECODE\_ATTEMPT |
| --------- | ------------------------ |
| 101       | "6@\u0005\u001e넭)"       |
| 102       | "6@\u0005\u001e넭)"       |
| 103       | "6@\u0005\u001e넭)"       |

### Example 4: Decoding an empty base64 string

**Goal**: Show the result of decoding an empty base64 string.

**XQL code**:

```sql
config timeframe = 1d 
| dataset = sample_xql_raw 
| alter decoded_empty_string = convert_from_base_64("") 
| fields event_id, decoded_empty_string 
| limit 3 
```

**Explanation**: Decoding an empty base64 string results in an empty string.

**Output**:

| EVENT\_ID | DECODED\_EMPTY\_STRING |
| --------- | ---------------------- |
| 101       | ""                     |
| 102       | ""                     |
| 103       | ""                     |

## Related articles

* **Stages**: [`alter`](/xql-command-reference-guide/readme/stages/alter.md), [`config`](/xql-command-reference-guide/readme/stages/comp.md), [`fields`](/xql-command-reference-guide/readme/stages/fields.md), [`limit`](/xql-command-reference-guide/readme/stages/limit.md)
* **Functions**: [`convert_to_base_64`](/xql-command-reference-guide/readme/functions/convert_to_base_64.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/convert_from_base_64.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.