URL-Safe Base64 Encoder - Base64url Encode & Decode

How to use this tool

1. Choose a tool tab. Select Encode or Decode for one conversion, Compare to view the standard and URL-safe spellings, or JWT Peek to inspect a token header and payload.
2. Enter text, bytes, or encoded data. Encode UTF-8 text or whitespace-separated hex bytes. Decode accepts Base64url and, when enabled, standard Base64 with whitespace ignored.
3. Review the live result. The result updates while you type. Choose optional padding for encoding or switch decoded output between UTF-8 text and hexadecimal bytes.
4. Copy or inspect further. Copy a conversion or comparison row. JWT Peek shows human-readable standard time claims but does not verify a signature; use JWT Decoder for additional inspection.

What is Base64url?

Base64url (URL-safe Base64) is defined in RFC 4648 §5. It is identical to standard Base64 except:

• + is replaced with -
• / is replaced with _
• Padding (=) is typically omitted

These changes make the output safe to embed in URLs, file names, and HTTP headers without percent-encoding.

Where is Base64url used?

• JWTs (JSON Web Tokens): header and payload are Base64url-encoded
• OAuth 2.0 PKCE: code verifier and challenge
• WebAuthn / FIDO2: challenge and credential IDs, which are binary values that can be inspected as hex bytes
• URL shorteners: compact binary-to-text IDs
• Web Crypto API: key export formats

These values are bytes, not always human-readable text. Choose Hex bytes when inspecting credential IDs, cryptographic output, or any decoded data that is not valid UTF-8. For ordinary messages, Text (UTF-8) is easier to read. Both modes preserve the same underlying bytes.

Standard Base64 vs Base64url

JWT Peek tab

The JWT Peek tab decodes a JSON Web Token's header and payload as you type so you can inspect claims like sub, iat, exp, and aud, all without sending the token anywhere.

Numeric iat, nbf, and exp claims are shown as local dates and relative times using your device clock. Server clock-skew settings can differ. Use the JWT Decoder for more claim inspection; neither page treats a decoded token as trusted.

Important: this tool does not verify the signature. Use server-side JWT libraries for trusted verification.

Anatomy of a JWT

A JSON Web Token consists of three Base64url-encoded segments separated by dots: header.payload.signature. Here is a worked example:

Common standard claims in the payload: sub (subject - user ID), iat (issued-at - Unix timestamp), exp (expiration - Unix timestamp), aud (audience - intended recipient), iss (issuer). Custom claims can be added for application-specific data.

To prepare a PKCE verifier and challenge, use the OAuth PKCE Generator. For ordinary padded Base64 or file encoding, see the Base64 Encoder. The String Byte Counter can help check UTF-8 byte length before you encode a value.