Base64 URL-safe encoder
Encode text as URL-safe Base64 (the alphabet JWTs use), decode either flavor back to text, or convert between standard and URL-safe forms.
result
result appears here
Why standard Base64 breaks URLs
Standard Base64 uses +, / and = — all of which collide with URL syntax: + decodes to a space, / delimits paths, and = separates keys from values. base64url (RFC 4648 §5) swaps + for -, / for _, and drops the padding, producing strings safe to place anywhere in a URL.
The encoding behind JWTs
Every JSON Web Token is three base64url segments joined by dots — header, payload, signature. Paste a JWT segment into the decoder to read its JSON, or encode data the same way for state parameters, share tokens, and webhook signatures.
Frequently asked questions
- What is the difference between Base64 and Base64url?
- Base64url (RFC 4648 §5) is Base64 with a URL-safe alphabet: + becomes -, / becomes _, and the = padding is dropped. The change matters because +, / and = all collide with URL syntax — + decodes to a space, / splits paths, = separates keys from values.
- Why won't my JWT segment decode as regular Base64?
- JWT segments use unpadded base64url. Strict Base64 decoders reject the missing = padding and the - and _ characters. This tool accepts both alphabets, padded or not, and restores padding automatically before decoding.
- Is Base64 encryption?
- No. Base64 is an encoding, not encryption — anyone can reverse it instantly. A JWT's payload is readable by anyone who holds the token; the signature only prevents tampering, not reading. Never put secrets in Base64-encoded URL data.