Base64URL Decoder: Decode URL-Safe Base64

How to decode Base64URL

1. Paste the string into Input · Base64. The page opens with a URL-safe sample.
2. Read the result in Output · text. The status line shows the variant (Base64URL or Standard), the decoded byte count and the detected type. If the padding was missing, it says “Missing padding added automatically.”
3. JSON, the usual content of tokens, is indented by Pretty-print JSON.
4. For binary content, such as hashes or random IDs, the tool says the data is binary and links to a matching decoder.
5. Copy output or Download the result.

To encode, use the Base64URL encoder. To convert a Base64URL string to standard Base64 without decoding it, use Base64URL to Base64.

Examples

For the hash in the last row, text output is meaningless. Open it in Base64 to hex to see the bytes as 13 d3 1e 96 ....

Padding and why it can be restored

Base64URL is usually written without =. That loses no information: a valid string has a length of 4n, 4n + 2 or 4n + 3 characters, and the remainder tells the decoder whether one or two bytes are in the last group. The tool adds the missing = before decoding and says so in the status line.

A length of 4n + 1 can never occur. If you see the error “Wrong length: one character too many or too few”, a character was lost or added when the value was copied, for example at a line break in an email or a log. Padding explained shows the arithmetic.

Many standard decoders are less forgiving. atob() in browsers rejects - and _ with InvalidCharacterError, and Python’s base64.urlsafe_b64decode raises Incorrect padding when = is missing.

Tokens, cookies and URL parameters

• JWT. A token looks like xxxxx.yyyyy.zzzzz. The first two parts are Base64URL JSON, the third is the signature, which is binary. Decode the parts one at a time here, or paste the whole token into the JWT decoder, which also shows expiry and verifies signatures. Base64 in JWT explains the format.
• Cookies and session IDs. Some framework session cookies, Flask’s for example, join Base64URL data and a signature with dots. Decode the data part only.
• URL parameters. OAuth state, redirect targets and share links sometimes carry Base64URL JSON. If the value contains %2F or %2B, it was percent-encoded on top and needs URL decoding first.

If a string mixes - or _ with + or /, the decoder stops with “The input mixes standard (+ /) and URL-safe (- _) characters”. That usually means two values were joined or one was converted only partly.

Base64URL decode in code

// Node.js
Buffer.from("c3ViamVjdHM_X2Q", "base64url").toString("utf8");   // "subjects?_d"

// Browsers with Uint8Array.fromBase64
new TextDecoder().decode(Uint8Array.fromBase64("c3ViamVjdHM_X2Q", { alphabet: "base64url" }));

import base64

def b64url_decode(s: str) -> bytes:
    return base64.urlsafe_b64decode(s + "=" * (-len(s) % 4))

b64url_decode("eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9")   # b'{"alg":"HS256","typ":"JWT"}'

The padding line works for any input length that is valid Base64. More in Base64 in Node.js, JavaScript and Python.

FAQ