Base64URL Encoder & Decoder

Two alphabets, one name

Standard Base64 uses plus and slash as its final two characters and pads with equals signs. All three are problematic in a URL: plus means a space in a query string, slash is a path separator, and the equals sign has to be percent encoded. Base64URL swaps plus for hyphen and slash for underscore and drops the padding entirely. It is defined in RFC 4648 section 5 and is the encoding used by JWT, JWS, JWE, WebAuthn credential IDs, OAuth PKCE code challenges and most modern token formats.

The padding question

Base64URL omits trailing equals signs, which is why a JWT segment often has a length that is not a multiple of four. Many decoders reject that input outright. The fix is to add back one or two equals signs so the length becomes a multiple of four, which this tool does automatically. Going the other way, leaving padding on a value that will travel in a URL is the mistake that produces a token which works locally and breaks behind a proxy.

Encoding is not encryption

Base64URL is reversible with no key, so a JWT payload is readable by anyone holding the token. That is by design: the signature protects integrity, not confidentiality. Decoding a token you were given is a legitimate debugging step, but treat everything you find in it as public, and never put a secret in a claim.

Related tools

• JSON Formatter — Format and beautify JSON in your browser. Pinpoints syntax errors by line and column, flags unsafe integers, and never uploads your data to a server.
• JSON Validator — Validate JSON syntax with precise line and column errors, and check documents against a JSON Schema. Runs locally in your browser, nothing uploaded.
• Regex Tester — Test regular expressions against sample text with live match highlighting, capture groups and flag control. Runs entirely in your browser.
• HTML Minifier — Minify HTML by removing comments and redundant whitespace, without breaking inline elements or pre blocks. Runs entirely in your browser.