Base64URL Decoder reversibly translates URL-safe Base64 strings back into human-readable text or structured JSON. If you are debugging an opaque authentication token retrieved from an HTTP request or trying to read the state object passed via an OAuth callback URI, this tool handles the padding restoration and character conversion needed to retrieve the original data effortlessly.
To safely pass through URLs without breaking routing logic, Base64URL encoding intentionally drops `=` padding and swaps standard URL-breaking characters for `-` and `_`. To decode this, the algorithm simply reverses the process: it replaces the safe characters back to `+` and `/`, dynamically recalculates and appends any missing `=` padding, and then runs a standard Base64 binary decoding back to an ASCII string.
Standard Base64 decoders fail because they legitimately do not recognize the `-` and `_` characters present in the URL-safe specification, and they often crash if the string is missing the expected `=` padding at the end.
Decoding them provides visibility, but remember that Base64URL is just obfuscation, not encryption. You should never assume data encoded this way is secure from prying eyes.
A JWT contains three separate Base64URL strings separated by periods (`.`). You cannot decode the whole thing as one string. You should either decode the middle segment here, or use our dedicated "JWT Decoder" tool.
The decoding algorithm will attempt to restore the string, but if the binary byte grouping is inherently broken (invalid length or foreign characters), it will return an explicit parsing syntax error.
No. Operations are executed 100% locally via your browser's native Javascript environment. It is completely safe for proprietary tokens.
Yes, it is entirely free to use.
Tool workspace
Free Base64URL decoder online — instantly decode URL-safe Base64 strings (like JWT payloads or query parameters) back into readable text or JSON. No login.
Output
Input
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9
Output
{"alg":"HS256","typ":"JWT"}