TFT

Encode & Decode JWT Base64Url Segments

Encode and decode the Base64Url segments of a JWT. Inspect the raw JSON of the header or payload, fix encoding issues, and understand the JWT structure at a granular level.

Base64URL Encoder/Decoder
Output

0 characters

Header

Payload

Base64 vs Base64URL
CharacterBase64Base64URLReason
++-URL unsafe
//_URL unsafe
== (padding)(removed)URL length optimization

How Base64URL Encoding Works in JWTs

JWT uses Base64URL encoding instead of standard Base64 to make tokens URL-safe. The tool converts between these formats by replacing problematic characters: + becomes -, / becomes _, and padding = is removed.

When encoding, your JSON payload gets stringified, then converted to Base64, then transformed to Base64URL. Decoding reverses this: Base64URL to Base64 (adding back padding), then atob() to get the original string.

Character replacement table:

Standard Base64: +
Base64URL: -
Standard Base64: /
Base64URL: _

This encoding ensures JWTs work safely in URLs, HTTP headers, and HTML forms without additional URL encoding overhead.

Real-World Use Cases

Manual JWT construction

You're building a JWT by hand for testing. After creating the header and payload JSON objects, you encode each segment to Base64URL before joining them with dots.

Debugging token parsing issues

Your backend rejects a JWT with "invalid encoding" errors. You decode the Base64URL segments to check for stray characters or missing padding.

Converting logs for analysis

Your application logs contain Base64URL-encoded JWT segments. You decode them to extract user IDs and timestamps for debugging session issues.

Creating test fixtures

Writing unit tests for JWT validation? Encode known payloads to Base64URL to create predictable test tokens with specific claims.

API documentation examples

You're writing API docs and need to show example JWT structures. Encode sample payloads to create realistic-looking tokens for documentation.

Validating token format before signing

Before sending a payload to your signing service, you encode it to Base64URL to verify the JSON structure is correct and fits size limits.

What to Know Before Using

Base64URL is not encryption.Anyone can decode Base64URL-encoded data. It's just a transport format, not security. Never put sensitive data (passwords, PII) in JWT payloads.

Padding matters for decoding.Base64URL removes = padding, but standard Base64 decoding requires it. The tool adds padding back automatically when decoding.

UTF-8 characters need care.JavaScript's btoa() only handles ASCII. For Unicode payloads, you need to UTF-8 encode first (using TextEncoder or similar).

JWT has three segments.A complete JWT is header.payload.signature. This tool encodes/decodes individual segments, not the full token structure.

Pro tip: When manually constructing JWTs, always validate your encoded payload by decoding it back. A single character error in Base64URL breaks the entire token.

Common Questions

Why does JWT use Base64URL instead of regular Base64?

Standard Base64 uses + and /, which have special meaning in URLs. Base64URL replaces these with - and _ so JWTs work in URLs without percent-encoding.

Can I decode a full JWT with this tool?

Decode each segment separately. Split the JWT on dots, then decode the header (first segment) and payload (second segment). The signature stays encoded.

What happens if my JSON has special characters?

JSON.stringify handles escaping automatically. Quotes become \", newlines become \n. The resulting string encodes cleanly to Base64URL.

Is Base64URL encoding reversible?

Yes, completely. Base64URL is a bijection—every input maps to exactly one output, and decoding always recovers the original data (assuming no transmission errors).

Why are there no equals signs in JWT tokens?

Base64URL omits padding (=) to keep tokens shorter. The decoder can infer the needed padding from the string length modulo 4.

Can I use this for non-JWT Base64URL encoding?

Absolutely. Any data that needs URL-safe Base64 encoding works—OAuth state parameters, secure random tokens, or any binary data in URLs.