decoding accepts standard and url-safe base64.

the file stays in this tab and is never uploaded.