Base64URL Decoder converts URL-safe Base64 strings back into readable text or JSON. Base64URL is a variant of Base64 that replaces + with - and / with _ to make it safe for use in URLs and HTTP headers. You encounter it in JWT tokens, OAuth state parameters, password reset links, and API tokens. Paste the encoded string and get the original decoded content instantly.
Base64URL differs from standard Base64 in two ways: it uses - and _ instead of + and / (which have special meanings in URLs), and it omits the trailing = padding characters. To decode a Base64URL string, the decoder reverses these changes — swapping back the characters and restoring the padding — then runs standard Base64 decoding to get the original bytes.
Standard Base64 uses + and / characters, which are not URL-safe. Base64URL replaces these with - and _ and removes the = padding. A regular Base64 decoder does not handle these character differences and will fail or produce wrong output. This tool handles the conversion automatically.
No. Base64URL is an encoding format, not encryption. It just changes how the bytes are represented as text — anyone who decodes the string can read the original content. JWT tokens use Base64URL for their header and payload but sign them with a secret key to prevent tampering. The signature does not prevent reading the payload.
A JWT has three parts separated by periods (header.payload.signature). Each part is Base64URL encoded separately. To decode the payload, paste only the middle segment. Or use the dedicated JWT Decoder tool on this site, which splits and decodes all three parts for you.
If the Base64URL string contains invalid characters or the byte length is incorrect, the decoder shows an error. Check that you copied the full string without extra spaces or truncation.
No. Decoding runs entirely in your browser. Your tokens and encoded strings never leave your device.
Yes, completely free with no account required.
Tool workspace
Free Base64URL decoder online — instantly decode URL-safe Base64 strings (like JWT payloads or query parameters) back into readable text or JSON. No login.
Output
Input
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9
Output
{"alg":"HS256","typ":"JWT"}