Input

Output

Formatted result will be displayed here

How do you decode URL-safe Base64?

URL-safe Base64 uses - and _ where standard Base64 uses + and /, and it often skips the trailing equals padding to stay compact. This decoder accepts the URL-safe variant, restores padding automatically, and interprets the resulting bytes as UTF-8 text. Use it whenever you copy a token out of a JWT, a query parameter, or a cookie and need to see the underlying content.

Use Cases

Inspect JWT header or payload

Split a JWT at the dots, decode the first two parts, and see the claims or algorithm without a dedicated library.

Decode opaque URL tokens

Many services put Base64URL-encoded state in query strings. Decode them to understand what the redirect is carrying.

Read OAuth PKCE values

Code verifiers and challenges are Base64URL. Decoding helps confirm your client is producing the shape the server expects.

Debug signed cookies

Session cookies often contain a Base64URL portion ahead of a signature; decoding exposes the payload for inspection.

FAQ

Do I need to add padding first?

No. The decoder restores any missing = characters automatically based on the input length.

Can I use it for standard Base64?

The URL-safe decoder accepts - and _ specifically. Use the regular Base64 decoder for the + and / alphabet.

What if the result is binary?

UTF-8 conversion will fail gracefully. The JWT spec embeds JSON, so if you are decoding a JWT part, it should always be printable text.

Does it verify JWT signatures?

No. This only decodes bytes. Use a dedicated JWT verifier if you need to check whether a signature is valid.