BYTETOOLS

Base64URL Decoder

Decode Base64URL (URL-safe Base64) back to text online. Restores missing = padding, validates the alphabet and decodes JWT segments. Free and 100% private.

What is the Base64URL Decoder?

The ByteTools Base64URL Decoder converts a URL-safe Base64 string — the variant used in JWT segments, web-push keys and OAuth tokens — back to readable text.

  • Decodes RFC 4648 §5 Base64URL (the JWT variant)
  • Automatic = padding restoration
  • Names the exact invalid character on bad input
  • Detects standard Base64 pasted by mistake
  • Hex preview for decoded data that is not UTF-8 text
  • 100% client-side — safe for tokens and secrets

How to use the Base64URL Decoder

  1. 1

    Paste the Base64URL string — a JWT header or payload segment works directly.

  2. 2

    Missing padding is restored automatically; whitespace is ignored.

  3. 3

    Read the decoded text, or a hex preview when the data is not UTF-8 text.

  4. 4

    Check the reported byte count.

  5. 5

    Copy the result with one click.

About the Base64URL Decoder

The ByteTools Base64URL Decoder converts a URL-safe Base64 string — the variant used in JWT segments, web-push keys and OAuth tokens — back to readable text. It maps - and _ back to + and /, restores the missing = padding automatically, then decodes the bytes as UTF-8.

Validation is precise: characters outside the Base64URL alphabet are named in the error, an impossible length is flagged as probable truncation, and input that contains + or / is recognised as standard Base64 with a pointer to the right tool. If the decoded bytes are valid data but not text, you get a hex preview instead of mojibake, along with the exact byte count.

Decoding runs 100% locally in your browser. Tokens and secrets you paste are never uploaded, logged or stored.

Frequently asked questions

How do I decode a Base64URL string?

Replace - with + and _ with /, add = padding until the length is a multiple of 4, then run a standard Base64 decode. This tool performs all three steps for you and then interprets the bytes as UTF-8 text, so pasting a raw JWT segment just works.

Can I decode a JWT with this tool?

You can decode any single segment — paste the part before the first dot to see the header JSON, or the middle segment for the payload. For a full three-part breakdown with claims explained, the dedicated JWT Decoder tool splits the token for you.

Why does my string fail with an invalid length error?

A Base64 string can never be exactly one character longer than a multiple of four — that length cannot be produced by encoding any number of bytes. Seeing this error almost always means the last characters were cut off when the value was copied.

What happens if the decoded data is not text?

Base64URL often wraps binary data such as signatures and keys. When the decoded bytes are not valid UTF-8, the tool shows a hex dump preview and the byte count instead of garbled characters, so you can still inspect the content.

Is it safe to paste authentication tokens here?

Yes. Decoding happens entirely in your browser with JavaScript — nothing is sent to a server, logged or stored. For defence in depth, you can load the page and go offline before pasting.

Related tools