Skip to content
English
All tools

Categories

Developer ToolsEncoding & DecodingJSON & DataHash & ChecksumText ToolsDate & TimeNetwork ToolsFile ToolsMarkdown & Diagrams

Base64URL Decoder

Paste a URL-safe Base64 string, such as a JWT segment, and read the text inside immediately.

Processed locally in your browser

Options
0 chars · 0 lines
The result will appear here.

What is Base64URL Decoder?

Base64URL swaps the "+" and "/" of ordinary Base64 for "-" and "_" and usually leaves out the "=" padding. It appears in JWTs, WebAuthn responses, signed URLs, session cookies and many API tokens.

This decoder is lenient on purpose: it strips whitespace, accepts both alphabets, restores missing padding and reads the bytes as UTF-8 (or Latin-1 on request). If the bytes are not text, you get a warning instead of a crash.

How does it work?

  1. Paste the Base64URL value; decoding runs as you type.
  2. Choose UTF-8 or ISO-8859-1 if the source text used a legacy encoding.
  3. Copy the result. For a whole token with header, payload and signature, use the JWT Decoder instead.

Common use cases

  • Reading the JSON header or claims of a JWT segment without a full JWT tool.
  • Inspecting a state or cursor parameter that an API hides behind Base64URL.
  • Checking what a signed-URL payload or cookie value actually contains.
  • Verifying the output of your own Base64URL encoder against a second implementation.

Examples

Try this input in the tool above:

Input
SGVsbG8sIEJhc2U2NFVSTCEgPj4-Pz8_
Output
Hello, Base64URL! >>>???

Privacy

Base64URL Decoder runs entirely in your browser. The text or files you provide are processed on your device and are not uploaded, logged or stored on our servers.

Limitations

Decoding does not verify a signature or prove the content is trustworthy, and binary payloads cannot be displayed correctly as text.

Frequently asked questions

Do I need to add "=" padding before decoding?

No. Missing padding is restored automatically, so both "Zg" and "Zg==" decode to "f".

Why does it say the input is invalid?

A single leftover character (length mod 4 = 1) or a symbol outside A–Z, a–z, 0–9, "-" and "_" cannot be Base64URL. Look for truncated text, quotes or a dot from a JWT.

Can it decode a full JWT?

Decode each dot-separated part separately here, or paste the whole token into the JWT Decoder to see header and payload side by side.

Related tools

More tools in Encoding & Decoding →