Base64url decode – URL-safe Base64 and JWT parts

Base64url vs. Base64

Base64url (RFC 4648 §5) is Base64 made safe for URLs and file names. Two characters change and the padding goes away:

+ becomes - and / becomes _
the trailing = padding is usually omitted

You meet it in JSON Web Tokens, OAuth PKCE challenges, WebAuthn and many short IDs. A strict standard Base64 decoder rejects it; this one accepts both.

Decoding in code

// Node.js
Buffer.from(s, 'base64url').toString('utf8')

// Browser
const b64 = s.replace(/-/g, '+').replace(/_/g, '/');
new TextDecoder().decode(Uint8Array.from(atob(b64), c => c.charCodeAt(0)))

# Python – add the padding back first
import base64
base64.urlsafe_b64decode(s + '=' * (-len(s) % 4))

Questions

How do I decode a JWT with this?

A JWT has three Base64url parts separated by dots. Paste the middle part (the payload) to read the claims, or the first part for the header – or paste the whole token into the JWT decoder, which also shows the dates and verifies the signature. Decoding alone proves nothing – never trust the content of a token just because it decodes.

Does the encoder produce Base64url?

The encoder writes standard Base64. To turn it into Base64url, replace + with -, / with _ and strip the trailing =.

Why do I get garbled characters?

The decoded bytes are not UTF-8 text – they may be binary data such as a signature, an image or compressed content.

About URL/HTML Encoder & Decoder

Introduction

Encoding and decoding are essential processes in web development, data security, and text processing. When working with URLs, HTML, Base64, and ASCII encoding, proper handling of special characters ensures compatibility, security, and readability. The URL/HTML Encoder & Decoder tool allows users to encode or decode text in multiple formats, making it easier to transfer, store, and process information correctly.

What is Encoding and Decoding?

Encoding transforms text into a format that can be safely transmitted or stored, while decoding reverses this process. Common encoding types include:

URL Encoding: Converts special characters into %XX format (e.g., space → %20).

HTML Entity Encoding: Replaces special HTML characters (<, >, &, etc.) with their safe equivalents (<, >, &).

Base64 Encoding: Encodes binary data into an ASCII string (often used for embedding images or transferring files in text formats).

ASCII Encoding: Converts characters to their ASCII numerical representations.

History and Origins

URL encoding became necessary with the rise of the World Wide Web in the 1990s. HTML entity encoding originated to prevent security vulnerabilities like Cross-Site Scripting (XSS) and ensure compatibility across different web browsers.

Base64 encoding was introduced in the early 2000s for encoding binary data in email attachments, data URIs, and authentication tokens.

Why is it Useful?

Prevents errors in URLs: Ensures that special characters like spaces or ampersands are correctly interpreted by web browsers.

Protects against security vulnerabilities: Encodes HTML to prevent malicious code execution (e.g., in form submissions).

Encodes binary data for safe transfer: Base64 is commonly used for images, authentication keys, and API requests.

Improves text compatibility: ASCII and HTML encoding maintain character integrity across different platforms.

Use Cases

Web Development: Safeguards URLs and HTML content from misinterpretation.

Cybersecurity: Prevents XSS attacks by encoding unsafe characters.

Email Communication: Ensures proper rendering of special characters in email clients.

API Data Transfer: Helps encode sensitive information in JSON or XML payloads.

Conclusion

Encoding and decoding are crucial for web security, data handling, and seamless communication between systems. This tool simplifies these processes, making it easy for developers, analysts, and security professionals to encode and decode text effectively.