Base64URL to Base64 Converter: Restore Padding

How to convert Base64URL to Base64

1. Paste the Base64URL into Input · Base64URL. Padding is optional, and standard + and / in the input are fine too.
2. The standard Base64 appears in Output · Base64, with - and _ turned into + and / and the padding restored.
3. Under the output, Padding (=) is on by default; Line wrap can break the result at 64 characters for PEM or 76 for MIME.
4. Copy output. The Base64 → Base64URL toggle, or Base64 to Base64URL, goes the other way.

How much padding to add

Base64 works in groups of 4 characters. Base64URL usually drops the = signs that fill the last group, so the length tells you how many to put back:

The well-known example payload eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ is 70 characters, a remainder of 2, so it becomes the same string with == appended. The padding guide has the full reasoning.

Why you might need standard Base64

Many decoders accept only the standard alphabet, and they fail in different ways when given Base64URL:

• GNU coreutils base64 -d prints whatever it decoded up to the first - or _, then base64: invalid input.
• Java Base64.getDecoder() throws IllegalArgumentException; Base64.getUrlDecoder() is the one for URL-safe input.
• .NET Convert.FromBase64String throws a FormatException for -, _ or a missing =.
• Python base64.b64decode is the dangerous one: by default it discards characters outside the standard alphabet without an error. b64decode("PDw_Pz8-Pg==") returns b'<<\x0f\xcf\xc3\xe0' instead of b'<<???>>'.

The last case is worth a test in any code that handles tokens. Wrong bytes with no exception usually surface much later, as a failed signature check or corrupted data.

Base64URL to Base64 in code

import base64

def b64url_to_bytes(s: str) -> bytes:
    return base64.urlsafe_b64decode(s + "=" * (-len(s) % 4))

b64url_to_bytes("PDw_Pz8-Pg")                              # b'<<???>>'
base64.b64encode(b64url_to_bytes("PDw_Pz8-Pg")).decode()   # 'PDw/Pz8+Pg=='

-len(s) % 4 is the number of missing = signs: 0, 1 or 2 for valid input. urlsafe_b64decode needs the padding, which is why it is added before the call.

function b64urlToB64(s) {
  const b = s.replace(/-/g, "+").replace(/_/g, "/");
  return b + "=".repeat((4 - (b.length % 4)) % 4);
}
b64urlToB64("PDw_Pz8-Pg");   // 'PDw/Pz8+Pg=='

In Node.js, Buffer.from(s, "base64url").toString("base64") does the same in one call. See the Python, Java and C# pages for the URL-safe decoders in each standard library.

Common problems

• “the last character group is incomplete”. The length leaves a remainder of 1. Part of the string was lost, often at a line break or because a URL was truncated.
• A . in the input. JWTs join three Base64URL segments with dots. Convert one segment at a time; the JWT decoder takes the whole token.
• %3D in the string. The value was percent-encoded on top of Base64URL. Decode it with URL decode first.

FAQ