Base64 encoder, decoder, and JWT viewer
Base64 turns bytes into sixty-four printable characters so they survive a URL, a header or a JSON string. This page encodes and decodes in the tab, accepts the URL-safe alphabet a JWT uses, and when the input has three segments it shows the header and payload as JSON while leaving the signature unchecked.
Encode or decode
Result
Decoded something that turned out to be JSON? Send it to the tool chain and format it in the same step.
- Bytes
- ·
- Alphabet
- ·
- Padding
- ·
- Requests
- · from Resource Timing
- Script
- · KB of a 100 KB budget
What this page does not do
Register row 12 is a compound claim: base64, hex and URL encoding, with a live image preview. This page does not do hex. It does not do URL encoding - that leg is /dev/url-encode. It does not decode base64 images or show a preview. It does not accept a custom alphabet, and it does not take file input. Those limits are deliberate so the register can be honest about what shipped.
The JWT panel that leaves the signature alone
When the input has exactly three base64url segments and you are decoding, the page shows the header and payload as the JSON those segments decode to and leaves the signature as base64url. The signature is not verified. Verifying it needs the signing key, and this page never sends your token anywhere. That notice is the differentiator among the tools we operated, and it is the safety line: reading the claims tells you what the token says, not whether it is genuine.
Character encoding is enumerated, not guessed
The selector lists six encodings: UTF-8, ISO-8859-1, ISO-8859-15, Windows-1252, UTF-16LE and UTF-16BE. On decode, bytes that are invalid in the selected encoding become the replacement character. On encode, a character the charset cannot represent becomes a question mark, and the page says so beside the result. The euro sign is the discriminator: it produces different base64 under ISO-8859-15 and Windows-1252, and is unrepresentable in ISO-8859-1.
Plus-slash versus minus-underscore, and an unsigned JWT
Encode three greater-than signs. The standard alphabet is Pj4+.
The URL-safe alphabet is Pj4-. Same bytes, one character swapped.
Paste either while Decode is selected and the page names which alphabet it saw.
An unsigned JWT is three base64url segments with algorithm none. Paste
eyJhbGciOiJub25lIn0.eyJzdWIiOiJkZW1vIn0. in Decode. The header
and payload print as JSON. The trailing empty signature stays unchecked.
That is reading claims, not verifying a token.
Alphabet named when the payload can decide it
RFC 4648 defines a standard alphabet with + and /, and a
URL-safe alphabet with - and _. A JWT uses the URL-safe
form, usually without padding. This page accepts either and adds padding when needed.
A string that contains + or / is standard; one that contains
- or _ is URL-safe. Shared characters only are valid in
both alphabets, and the page says so rather than guessing. Markers from both
alphabets in one string are valid in neither, and the page names that mix.
Share links stay in the fragment
The share link carries the pasted input, the mode and the character encoding after
the #. Browsers do not send a fragment to a server, which matters on a
page whose normal paste is a token. The link never carries a decoded JWT payload.
Questions
Can I decode a JWT here?
Yes. Paste the whole token while Decode is selected. The header and payload are shown as the JSON the segments decode to; the signature is shown undecoded and is not verified. A two-segment input is treated as ordinary base64 and does not open the panel.
Why does my encoded string end in equals signs?
Base64 works in groups of three bytes, which become four characters. When the input length is not a multiple of three, the last group is padded. The URL-safe form usually drops the padding because the length can be worked out anyway; this page accepts both.
Is base64 secure?
No. It is an encoding, reversible by anyone in one step. Anything encoded here can be decoded by anyone, including by this page.
Is my input uploaded?
No. Everything runs in this tab. Once the page has loaded, nothing you type leaves your browser. A build-time test fails the release if this page ever makes a request.
Where do I encode a URL or decode hex?
URL encoding is /dev/url-encode. Hex is not on this page and is not served by another tool yet; the register row that claims it is wrong until that is ruled.
Related tools
Once decoded, JSON is usually the next step: the JSON formatter indents it and names the line of any syntax error. For percent-encoding, use URL encoding. And the tool chain runs decode and format together on one paste.