43 characters · 9 words · 43 bytes (UTF-8)
Output will appear here
Click in the output to select all text
43 characters · 9 words · 43 bytes (UTF-8)
Output will appear here
Click in the output to select all text
Decode and inspect JSON Web Token headers, claims, expiration, and payload data.
Construct and sign a JSON Web Token using HS256 algorithm and a secret key.
Encode text to Base32 format (RFC 4648) and decode Base32 strings.
Encode text to hexadecimal byte representation and decode hex back to ASCII.
This Base64URL tool encodes text into URL-safe Base64 format and decodes it back, running entirely in your browser. Standard Base64 uses '+' and '/' characters that break URLs and file names, so Base64URL swaps them for '-' and '_' and typically drops the trailing '=' padding — this is exactly the variant used inside every JWT header and payload segment, as well as in URL query parameters and file-safe identifiers. Developers debugging JWT tokens, building URL shorteners, or encoding data for query strings will find this converter does exactly what's needed without any format surprises. All conversion logic runs as JavaScript locally on your device — no text is ever uploaded to a server, which is important if you're decoding a JWT payload that might contain sensitive claims. There's no signup and no rate limiting; results appear as you type. If you're working with full JWT tokens, this platform's JWT decoder handles the header/payload/signature breakdown for you automatically. Scroll down to encode or decode Base64URL text now.
Base64URL replaces the '+' and '/' characters used in standard Base64 with '-' and '_' respectively, and typically omits '=' padding, making the output safe to embed directly in URLs and filenames.
JWTs are often transmitted in URLs and HTTP headers, where standard Base64's '+', '/', and '=' characters would need extra escaping — Base64URL avoids that problem entirely.
No, it's just an encoding, not encryption — anyone can decode Base64URL data instantly, so never use it to hide sensitive information.
It can, but most implementations, including JWTs, omit the '=' padding characters since the decoder can infer the correct length.
Yes, pasting the middle segment of a JWT (between the dots) will decode its Base64URL-encoded JSON payload, though the dedicated JWT decoder tool provides a full structured breakdown.
Yes, like standard Base64, it increases size by roughly 33% since 3 bytes of input become 4 output characters.
Yes, it's a fully reversible encoding — decoding always recovers the exact original bytes.
What Is Base64 and Why Do Developers Use It?
What is Base64? A plain-English explanation of the 64-character alphabet, the 3-bytes-to-4-characters math, padding, the 33% size cost, and where it is used.
How to URL Encode a String (and When You Must)
URL encoding explained: which characters need percent-encoding, why a space is %20 in a path but + in a query string, and how to avoid double-encoding bugs.
Base64 Is Not Encryption: Correcting a Dangerous Myth
Is Base64 encryption? No. Here is why encoding provides zero confidentiality, how anyone decodes it instantly, and what to use instead when data must stay secret.