Free Base64 URL Decoder Online
Decode Base64url strings to readable text instantly in your browser.
Input (Base64url)
Output
Base64 URL Decoding Examples
Paste a Base64url string (using - and _, no = padding required) to decode it back to text. Example:
Decode a Base64url string
Base64url input:
Decoded output:
Click Sample above to load a Base64url example.
What Is Base64 URL Decoding?
You've got a JWT token and need to peek at the payload, or you're debugging an OAuth PKCE flow and the code challenge looks like gibberish. Sound familiar? Base64url — defined in RFC 4648 Section 5 — swaps + for -, / for _, and drops the = padding so encoded data can live safely in URLs. This decoder reverses all of that automatically. The decoding itself happens on this page, through the atob() function your browser already has, so nothing ever hits a server.
Base64url strings appear in JWTs, OAuth 2.0 PKCE challenges, WebAuthn credentials, and URL-safe identifiers. This tool decodes any such string back to its original UTF-8 text. To encode text to Base64url, use the Base64 URL Encoder. For standard Base64 decoding, use the Base64 Decoder.
How to Use This Tool
Paste Your Base64url String
Paste the Base64url string into the left editor. It may contain - and _ and does not need = padding. Standard Base64 strings (with + and /) are also accepted. If you only want to see it in action, Sample drops in a token fragment.
Read the Decoded Output
Decoded text appears on the right the moment the string is complete. Before decoding, the page quietly normalizes the input: strips whitespace, converts -/_ to +//, and re-adds = padding as needed.
Copy or Download
Grab the decoded payload with Copy, or keep a record of it with Download, which writes a .txt file. Going the opposite way, from text to a URL-safe string, is the job of the Base64 URL Encoder.
How Base64url Decoding Works
This tool performs three normalization steps before decoding:
After normalization, the string is standard Base64 and decoded with the browser's built-in atob() function. The raw bytes are then decoded as UTF-8 using TextDecoder, which correctly handles multi-byte Unicode characters.
Frequently Asked Questions
Is my data private?
Yes. The string is decoded by script on this page, and the tokens or PKCE values you paste are not transmitted anywhere. Keep the Network tab of your DevTools open while you decode and you will see no request go out.
Do I need to add = padding before pasting?
No. This tool automatically calculates and adds any missing = padding based on the input length. Paste the raw Base64url string as-is.
Can I decode standard Base64 here?
Yes. Standard Base64 (with +, /, and =) is also accepted. The tool decodes both formats. For a dedicated standard Base64 decoder, use the Base64 Decoder.
Can I decode JWT payloads here?
Yes. A JWT is three Base64url segments joined with dots: header, payload, signature. Paste just the segment between the two dots and you get the payload JSON back. The header (first part) can be decoded the same way. The signature (third part) is binary and will not decode to readable text.
What if the output looks garbled?
The input may contain binary data (not text). Binary data decoded as UTF-8 may produce garbled output. If you need to recover a binary file from Base64, use the Base64 to File tool which lets you download the raw bytes.
Related Tools
For the formal specification, see RFC 4648 Section 5. JWT introduction explains how Base64url is used in tokens.