Decode URL-safe Base64 – the variant used in JWT header and payload sections – back to text, handling missing padding automatically.
Show calculation steps
Processed privately in your browser — nothing you paste is uploaded, logged or stored.
How to use the Base64URL Decoder
- Paste the Base64URL string – for example a single section copied from between the dots of a JWT.
- Leave "Strict alphabet" off unless you specifically want to reject standard-alphabet characters.
- Click "Decode Base64URL" to see the original text.
- For a full token, use the JWT Decoder instead, which splits and labels all three sections for you.
Frequently asked questions
Do I need to add the missing "=" characters first?
No. The decoder infers the correct length and restores padding internally, which is why unpadded JWT sections decode without any manual editing.
Why does the signature section produce gibberish?
Because a JWT signature is not text – it is the raw bytes of an HMAC or a digital signature. Switch the binary option to "Hex dump" to view those bytes. Only the header and payload sections decode to readable JSON.
What if my string contains a plus or a slash?
Then it is standard Base64, not Base64URL. The forgiving default decodes it anyway; strict mode reports it so you can confirm which variant a system actually produced.
Does decoding a JWT section prove the token is genuine?
No. Anyone can decode and even rewrite the header and payload. Only verifying the signature with the correct key proves authenticity, and that must happen on your server.
