Base64url encode & decode

Client

Base64url (RFC 4648 URL-safe) encodes the same bit pattern as standard Base64 but uses - and _ so the string is safe in URLs and many headers. Use it for the same UTF-8 pastes as other Base* tools on this site.

Part of encoding tools.

Workspace

Paste text, encode to Base64url, or paste a segment and decode—output replaces the field.

Base64url (URL-safe Base64)

?

RFC 4648 “URL and filename safe” alphabet: - and _ instead of + and /. This page encodes the same bytes as standard Base64 but in the shape JWT segments and many APIs use. Output omits = padding; the decoder still accepts it if you paste a padded string.

This is an encoding, not signing—JWT verification needs crypto keys in your app.

Common use cases

  • Decode a pasted JWT header or payload segment (the middle or first dot-separated part) into JSON-looking text for inspection—without verifying signatures here.
  • Encode UTF-8 to Base64url for configs that reject + and / in tokens.
  • Compare string length and charset with the standard Base64 page on the same text.

Common mistakes to avoid

  • Confusing with the Base64 & URL page

    The Base64 & URL tool focuses on standard Base64 plus encodeURIComponent. This page is only Base64url (RFC 4648 Section 5) for the byte alphabet.

  • Expecting HMAC or signature checks

    This tool only transforms text; it does not validate JWTs or API tokens.

FAQ

Why does encoding omit = padding?

Many specs transmit Base64url without padding; the decoder on this page reconstructs it when needed.

Does data leave my browser?

No. Encoding runs entirely on your device.

Common search terms

Phrases people search for that match this tool. See the full long-tail keyword index.

  • base64url encode decode online
  • rfc 4648 url safe base64
  • jwt base64url segment decoder
  • utf-8 to base64url browser

More tools

Related utilities you can open in another tab—mostly client-side.