Base64URL Encoder and Decoder

How to use

1. 1Choose a mode: Encode (text or bytes to Base64URL), Decode (Base64URL back to text or bytes), or Convert variant (between standard Base64 and Base64URL).
2. 2For Encode, pick whether the input is UTF-8 text or hex bytes, then type or paste it. Tick Keep = padding only if the target API requires it.
3. 3For Decode, paste the Base64URL string (padding optional) and choose UTF-8 text or Hex bytes for the output.
4. 4For Convert variant, set the direction (Standard to Base64URL or Base64URL to standard) and paste the string to translate.
5. 5Read the output and the note showing the byte count and what changed; in Encode mode compare it against the standard Base64 form shown below.
6. 6Click Copy to grab the result, or use the swap button to feed the output straight back in for the inverse operation.

About this tool

Base64URL Encoder and Decoder works with the URL-safe and filename-safe variant of Base64 defined in RFC 4648 section 5. It is the encoding you meet in JSON Web Tokens, where the header, payload, and signature are each Base64URL with no padding, and in JSON Web Keys, OAuth 2.0 PKCE code verifiers and challenges, WebPush keys, signed URLs, and anywhere binary data is dropped straight into a URL, a query string, or a filename. Base64URL differs from ordinary Base64 in exactly two ways, and both exist because the standard alphabet collides with characters that are reserved in a URL. The two final alphabet characters change: a plus sign becomes a hyphen and a forward slash becomes an underscore, so the output never needs percent-encoding. The trailing equals-sign padding is normally removed as well, because the equals sign is also reserved in query strings and the length by itself is enough to decode the data. The underlying bytes are identical to standard Base64; only the text representation changes, which is why a value produced by one library so often needs translating before another service will accept it. This tool covers the three jobs that come up in practice. Encode turns UTF-8 text or raw hex bytes into a Base64URL string, with a checkbox to keep the equals padding when an API insists on it, and it shows the standard Base64 form side by side so you can see exactly which characters were swapped. Decode turns a Base64URL string back into text or hex; it accepts input with or without padding, restores the padding internally so the bytes line up, and leniently accepts plus and slash too, so a pasted standard Base64 string still decodes. When the bytes are not valid UTF-8 text the decoder says so and points you to the hex output rather than returning silent mojibake, and it rejects strings whose length could never have come from real data. Convert variant translates between standard Base64 and Base64URL in either direction without touching the bytes, which is the operation you reach for when one tool handed you the wrong variant. Invalid input is reported with the exact offending character and a hint about which mode or direction you probably meant. Everything runs locally in your browser using the native TextEncoder, TextDecoder, btoa, and atob, so the tokens, keys, and data you paste are never uploaded, logged, or stored.

Free to use. Works in your browser. No signup, no login.