Base64URL Decoder Guide: Read a JWT, Then Verify It
Decoding just swaps the alphabet back. Seeing an admin role in a payload does not make the token trustworthy; only a server-side signature check can do that.
Open the tool：Base64URL Decoder
The most common use: reading a JWT
While debugging a login flow, paste the middle segment and read the subject, expiry, and scope directly. The payload is Base64URL JSON, so no key and no network round trip are needed.
The other use is link parameters: share links, callback URLs, and tracking parameters often carry JSON compressed into Base64URL. Decoding shows what was actually passed instead of guessing from the encoded string.
- Inspecting JWT headers and payloads
- Restoring data in share links and callback parameters
- Checking OAuth state and PKCE values
Why decoding fails
The tool maps minus and underscore back to plus and slash, pads to a multiple of four, then decodes. Failures usually mean the string was truncated, a percent-encoded space or a Chinese character slipped in from the URL, or the input was never Base64URL to begin with.
There is also the case where it decodes to garbage: the bytes are not UTF-8 text, which usually means ciphertext, compressed data, or an image. Base64 only promises the bytes survive; it says nothing about whether they are readable.
- Confirm the string is complete and not split by a line break
- Strip leftover percent-encoding and spaces from URLs
- Garbage output means the source was not text
Boundary: readable is not trustworthy
The header says which algorithm was used, but that field is attacker-controlled. The classic "alg: none" attack exploits clients that trust it. Verification must happen on the server, with the expected algorithm and a trusted key.
Base64URL is not encryption, and decoding needs no key, so anyone can do exactly what you just did. Keep decoding, decryption, and verification separate: decoding answers what is inside, verification answers who signed it.
- The algorithm field is attacker-controlled
- Verification must happen on the server
- Decoding, verification, and decryption are three jobs
FAQ
The output is garbage
The bytes are not UTF-8 text. They may be ciphertext, a compressed payload, or an image; Base64 only moves bytes around. Identify the source, then use the matching decryption or decompression tool.
Do I need to add padding myself?
No, the tool pads automatically. If you do it by hand, the total length must be a multiple of four; the wrong number of equals signs silently decodes to something else.
Can it verify a JWT signature?
No. It only decodes. It holds no key and checks no certificate. Signature verification belongs on the server with a trusted key; anything decoded in the browser is for inspection only.
Related tool：Base64URL Decoder