Decode Base64URL
Paste Base64URL — from a JWT, a URL or an API — and get the decoded content with normalization, padding and UTF-8 handled automatically.
Input — Base64URL○ Waiting for input
ⓘ Nothing to convert yet
Nothing to convert yet — paste your data or drop a file to begin.
Inspection Report
Result metadata
- Detected Type
- —
- MIME Type
- —
- Encoding
- —
- Input Length
- —
- Decoded Size
- —
- Padding Status
- —
- Data URI
- —
- File Signature
- —
- Preview Availability
- —
How to decode Base64URL
To decode Base64URL, paste the string into the tool above. It automatically converts the URL-safe characters - and _ back to standard Base64, adds any missing padding, and decodes the result. Valid UTF-8 content is shown as readable text; binary data is detected and shown as a hex preview. Everything runs locally in your browser.
How to Use
- Paste the Base64URL string into the input box — a JWT segment, a URL token or any URL-safe encoded data.
- The tool normalizes - to + and _ to /, and adds missing padding automatically.
- Check the inspector: it shows the encoding, the normalized standard Base64, and the decoded length.
- Read the result as UTF-8 text, or as a hex preview if the content is binary.
- Click Copy to take the decoded result.
Real Example
A JSON Web Token's header segment eyJhbG...VCJ9 contains the URL-safe character patterns JWTs are known for and no padding. Paste it and the tool normalizes the string, adds the implied padding, and decodes it to the readable JSON {"alg":"HS256","typ":"JWT"}. The inspector shows the normalized Base64 alongside, so you can see exactly what transformation happened.
Code Snippets
// Decode Base64URL to UTF-8 text (browser)
function decodeBase64Url(s) {
const b64 = s.replace(/-/g, '+').replace(/_/g, '/');
const padded = b64 + '='.repeat((4 - (b64.length % 4)) % 4);
return new TextDecoder().decode(Uint8Array.from(atob(padded), c => c.charCodeAt(0)));
}How Base64URL Decoding Works
Base64URL is the standard Base64 alphabet with two substitutions — - for + and _ for / — so the result can sit safely inside URLs and filenames; padding is usually dropped for the same reason. That is why naive decoders choke on it: they meet characters outside the standard alphabet and lengths that are not multiples of 4. This tool performs the normalization and re-padding explicitly, then decodes. Because the decoded bytes are not always text — tokens can hold binary — the result is checked for valid UTF-8 and shown as a hex preview when it is not, instead of as garbage characters.
Common Use Cases
- Reading the header and payload segments of JSON Web Tokens.
- Decoding URL tokens from authentication and password-reset links.
- Inspecting Base64URL fields in API responses and webhooks.
- Debugging systems that switch between standard Base64 and Base64URL.
FAQ
What is the difference between Base64 and Base64URL?
Base64URL is the URL-safe variant of Base64: it replaces + with - and / with _, and padding is usually omitted, so the string can be used safely in URLs and filenames.
Do I need to add padding before decoding Base64URL?
No. The tool detects the missing padding and adds it automatically as part of normalization.
What happens if the decoded data is not UTF-8 text?
The tool detects that and shows the content as a hex preview instead of garbled text, and the inspector tells you the exact decoded length in bytes.
Where does Base64URL show up in real systems?
Most commonly in JSON Web Tokens, URL-safe tokens in authentication links, and web frameworks that pass encoded data through URLs.