About Base64URL Decode
Base64URL Decode turns the URL-safe form of Base64 back into readable text. Paste a string such as SGVsbG8sIHdvcmxkIQ and the panel returns "Hello, world!" - the two characters that make the encoding URL-safe are put back to their standard equivalents before the data is decoded.
The URL-safe alphabet exists because standard Base64 uses a plus sign and a forward slash, both of which mean something in a URL and in a filename. The safe variant swaps them for a hyphen and an underscore and drops the trailing padding. This page reverses all three changes: the substitutions are undone, the padding is restored and the string is passed to the browser's decoder, which handles multi-byte characters correctly.
Whitespace is removed first, so a value that has been wrapped across several lines - a JWT pasted from a header or a data block copied out of a config file - decodes cleanly without you having to join the lines yourself.
How to use Base64URL Decode
- 1 Paste the URL-safe Base64 string into the text panel.
- 2 Read the decoded text from the result, which updates as you type.
- 3 Leave the line breaks in if they are there - whitespace is stripped before decoding.
- 4 Use the separate Base64URL Encode tool if you need to go back the other way.
Frequently asked questions
Can I decode a JWT with this?
You can decode either half of one, since the header and the payload of a JWT are both Base64URL. What the page will not do is check the signature or tell you that the string you pasted was the first part rather than the second - it returns plain text for whatever it is given and leaves the interpretation to you.
Why does my input throw an error instead of decoding?
Because the browser's decoder rejects anything outside the Base64 alphabet. A string with a stray character, or one whose length cannot be repaired by adding padding, will fail rather than decode to something approximate. There is no lenient mode and no error message beyond the decoder's own.
Does it matter whether I use the standard or the safe alphabet?
The safe alphabet is the one this page expects. A hyphen is read as a plus and an underscore as a slash, so a string that came from standard Base64 is usually still decoded correctly as long as it does not contain padding - but the tool is the wrong way round for that job, and the standard decoder is a better fit.
Can it encode as well as decode?
No. The operation is fixed in the decoding direction, with no switch and no reverse button. The matching encoder is a separate page, which keeps each tool to a single clear job but does mean round-tripping a value takes two visits.
Free, online, and private
Free to use
Base64URL Decode is completely free. There is no account to create, no login, and no hidden charge or usage limit.
Runs online in your browser
It is a free online tool that runs entirely in your browser. Nothing to download or install — open the page and start using it right away.
Your data stays private
All processing happens locally on your device. Your input is never uploaded, stored, or tracked, so it never leaves your browser.
How Base64URL Decode behaves in detail
These are the specifics of this implementation — the exact ranges, defaults and fixed settings you are working with.
| Parameter | Value |
|---|---|
| Input | a text panel holding the URL-safe Base64 string; the sample value is "SGVsbG8sIHdvcmxkIQ" |
| Character mapping | the two URL-safe substitutions are reversed first - hyphen back to plus and underscore back to slash |
| Padding | the equal signs removed by the encoder are put back, and the length is topped up until it divides by four |
| Decoding step | atob, then the bytes are read back through a UTF-8 decoder, so multi-byte characters survive |
| Whitespace | all whitespace is stripped before decoding, so line breaks pasted from a JWT or a header do not break the result |
| Failure mode | an invalid alphabet or a broken length throws from atob and no friendly message is returned in its place |
Compiled from the implementation of this tool and checked against it by itoolnet.
What Base64URL Decode does not do
Knowing the edges of a tool saves more time than another list of its features. These are the cases where it will not do what you might expect.
- It decodes only, with no counterpart on the page. There is no switch or button to encode the text back into URL-safe Base64, so round-tripping has to be done through the separate Base64URL Encode tool.
- It does not verify what it decodes. A JWT is Base64URL on both the header and the payload, but this page returns raw text for either half and does not check the signature, does not parse JSON and does not tell you whether the string you pasted was the header, the payload or neither.
- The input is not treated as a stream. The whole string is held in the editor and decoded in one synchronous pass, with no upper bound, no per-line handling and no size check, so a very large paste is handled only by atob throwing rather than by any guard on the length.
Tested and documented by itoolnet, the team that builds and maintains this site.