What is the difference between Base64 and Base64URL?

Standard Base64 uses + and / as the 62nd and 63rd characters, and = for padding. These characters are not safe in URLs. Base64URL replaces + with -, / with _, and strips the trailing = padding — making it safe to use directly in URLs and JSON without percent-encoding.

Does this tool add or strip padding?

Encoding always outputs unpadded Base64URL (no trailing =), which is the standard for JWTs per RFC 7515. Decoding accepts both padded and unpadded input.

Can I decode a JWT header or payload here?

Yes. Split your JWT on the dots, paste the first segment (header) or second segment (payload) into the input, and choose Decode. The result is the raw JSON. This tool does not verify the signature — use a dedicated JWT debugger for that.

What character set does Base64URL use?

A–Z, a–z, 0–9, - (hyphen), and _ (underscore). That is 64 characters total, all URL-safe and JSON-safe without escaping.

Is this computed in my browser?

Yes — all encoding and decoding runs in JavaScript in your browser. Nothing is sent to any server.

Base64URL Encoder / Decoder

Name: Base64URL Encoder / Decoder
Availability: InStock
Author: Nham Vu

Convert text or binary to Base64URL (URL-safe Base64) and back — no padding, no +/= characters that break URLs.

Mode: Encode (text → Base64URL) Decode (Base64URL → text)

UTF-8 text output

Input text

0 chars

Base64URL output

Output will appear here…

—

Base64URL vs Standard Base64

Property	Standard Base64	Base64URL (RFC 4648 §5)
Character 62	+	- (hyphen)
Character 63	/	_ (underscore)
Padding	= (required)	omitted (JWTs)
URL-safe	No — needs percent-encoding	Yes — no escaping needed
Used in	Email (MIME), general data	JWTs, OAuth PKCE, WebAuthn

Copied!

Summary

Convert text or binary to Base64URL (URL-safe Base64) and back — no padding, no +/= characters that break URLs.

How it works

Paste or type your text (or hex bytes) into the input box.
Choose Encode or Decode mode.
The result appears instantly in the output panel.
Click Copy to copy the result to your clipboard.
Use the Swap button to move output back to input for chained operations.

Use cases

Inspect the header or payload of a JWT token.
Generate a PKCE code verifier and code challenge for OAuth 2.0.
Encode binary data for use in URL query parameters.
Decode Base64URL strings received from an API response.
Verify that a Base64URL value round-trips without data loss.
Understand the difference between standard Base64 and URL-safe Base64.

Frequently Asked Questions

Last updated: 2026-07-01 · Reviewed by Nham Vu