Base64url decode and encode.
Paste Base64url — or standard Base64, or a whole JWT — and get the text back; or encode text to Base64url with or without = padding. Runs in your browser; nothing is uploaded.
Base64url vs Base64
Base64url is Base64 with two characters swapped so the output is safe in URLs and file names. It is defined in RFC 4648 §5.
| Base64 | Base64url | |
|---|---|---|
| Character 62 | + | - |
| Character 63 | / | _ |
| Padding | = to a multiple of 4 | Usually omitted (JWTs and many APIs require no padding) |
| In a URL | + / = must be percent-encoded | Can be used as-is |
Everything else is identical: three bytes become four characters. That is why this decoder accepts both alphabets — and tells you which one it saw.
Where you’ll meet it
- JWTs — header, payload and signature are each Base64url without padding, joined by dots. Paste one to read it; the signature is not verified.
- OAuth PKCE — the
code_challengeis the Base64url-encoded SHA-256 of the verifier, without padding (RFC 7636). - Links and IDs — short IDs, signed URL tokens and email-tracking links often carry Base64url data in a parameter. The URL X-ray spots these automatically.
In code
- JavaScript (Node):
Buffer.from(s, 'base64url').toString()andBuffer.from(text).toString('base64url'). - Python:
base64.urlsafe_b64decode(s + '=' * (-len(s) % 4))— Python requires the padding back — andbase64.urlsafe_b64encode(b).rstrip(b'='). - Java:
Base64.getUrlDecoder().decode(s)andBase64.getUrlEncoder().withoutPadding().encodeToString(bytes). - Go:
base64.RawURLEncoding(no padding) orbase64.URLEncoding(with padding).
Sources & standards
- RFC 4648 §5 — Base 64 Encoding with URL and Filename Safe Alphabet. rfc-editor.org/rfc/rfc4648
- RFC 7515 §2 / RFC 7519 — Base64url without padding in JWS and JWT. rfc-editor.org/rfc/rfc7515
- Language docs: Node Buffer, Python base64, Java Base64, Go encoding/base64.
Common questions.
Base64 with - and _ instead of + and /, usually without = padding, so the result can go into URLs and file names without escaping. It is defined in RFC 4648 §5.
Paste it above. By hand: replace - with + and _ with /, add = until the length is a multiple of 4, then decode it as normal Base64.
Common causes: a character outside the alphabet (often a space or line break from copying), a mix of + / and - _, or a truncated string. The decoder above names the problem.
No. It is an encoding — anyone can reverse it. A JWT’s payload, for example, is readable by anyone who has the token.
No. It decodes the header and payload so you can read them. Verifying the signature needs the issuer’s secret or public key.
More from the toolkit.
About this page. Written and maintained by Sri Murugan Systems, the developer of urlencodedecode.com. Behaviour follows RFC 4648 §5; output was checked against Python’s base64 module.