Base64url Decode

What the Base64url Decode tool does

This turns Base64url, the URL-safe version of Base64, back into the original text. Paste the Base64url in, press Convert, and copy or download the result. It is the reverse of the Base64url Encode tool, and it is built to read the URL-safe form that a plain Base64 decoder often cannot.

It runs in your browser, so nothing you enter is uploaded.

How to use it

1. Paste your Base64url. Type or paste it, or upload a plain text file.
2. Press Convert. The decoded text appears, ready to Copy or Download.

How it handles the URL-safe form

Base64url differs from ordinary Base64 in two small ways, and both would trip up a standard decoder, so this tool handles them for you. First, Base64url uses a hyphen where regular Base64 uses a plus sign, and an underscore where it uses a slash, so the tool swaps those back before decoding. Second, Base64url usually leaves off the equals-sign padding at the end, so the tool works out how much padding belongs and restores it. With those two adjustments made, it decodes the result just as it would normal Base64. That is why you can paste a URL-safe string here and get the right answer, where a plain Base64 decoder would report an error.

Decoding a JWT, and a word of warning

A very common reason to be here is a JWT, a JSON Web Token, whose parts are written in Base64url. A token has three sections separated by dots, and they do not all decode the same way. The first two, the header and the payload, are Base64url-encoded JSON, so decoding them gives you readable text, the actual data the token carries, which is genuinely useful for seeing what is inside. The third section, the signature, is different: it is raw binary data, not text, so decoding it here will produce a jumble of strange characters rather than anything readable. That is expected, not a fault, because the signature was never text to begin with. So decode the header and payload to read a token, and do not be alarmed when the signature comes out as nonsense.

Going the other way

If you have plain text and want to turn it into Base64url, that is the opposite job, handled by the Base64url Encode tool. And if your string is ordinary, non-URL-safe Base64 rather than the URL-safe form, the Base64 Decode tool is the one for that, and is also where the underlying decoding is explained in detail.

Questions people ask

Why does a normal Base64 decoder fail on my string?

Because Base64url uses a hyphen and underscore in place of the plus and slash, and usually drops the padding. A standard decoder does not expect those, so it errors. This tool adjusts for them first.

What about the missing equals signs?

Base64url normally leaves the padding off. The tool calculates how much is needed and adds it back before decoding, so you do not have to.

Can I use this to read a JWT?

Yes, for the first two parts. The header and payload are Base64url-encoded JSON and decode to readable text. The signature is binary and will look like nonsense, which is normal.

Why did part of my token decode to gibberish?

That is almost certainly the signature, which is raw binary rather than text. It was never readable to begin with, so decoding it gives a jumble. The header and payload are the readable parts.

References

1. Josefsson, S. (2006). RFC 4648: The Base16, Base32, and Base64 Data Encodings (Section 5 defines the URL and filename safe alphabet). Internet Engineering Task Force (IETF). https://www.rfc-editor.org/rfc/rfc4648
2. Jones, M., Bradley, J., Sakimura, N. (2015). RFC 7519: JSON Web Token (JWT). Internet Engineering Task Force (IETF). https://www.rfc-editor.org/rfc/rfc7519