About Base64URL Encoder
This Base64URL encoder writes your text in the URL-safe form of Base64, which uses - and _ in place of + and /. That form can sit in a URL, a filename or a cookie with no further escaping. It is free, needs no sign-up and runs in your browser, so nothing you enter is uploaded.
Base64URL is defined in RFC 4648 and is the encoding behind JSON Web Tokens. The header {"alg":"HS256","typ":"JWT"} becomes eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9, and the payload is encoded the same way. JWT drops the = padding, so untick Keep = padding to get the same result. The decoder in this tool reads the URL-safe form directly, so you can paste a JWT segment into Decode and read the JSON.
The difference from standard Base64 is only in two characters and the padding. Take the bytes of the text subjects?_d>>>: standard Base64 gives c3ViamVjdHM/X2Q+Pj4=, which contains a slash and a plus that would need percent-encoding in a URL. Base64URL gives c3ViamVjdHM_X2Q-Pj4 with the padding dropped.
A JWT is signed, not encrypted: anyone can decode the segments. Never put secrets in the payload.
How to use Base64URL Encoder
- Choose Encode to turn data into Base64, or Decode to turn Base64 back into the original.
- To encode, type or paste text, or choose File or image and pick a file from your device.
- Set the options you need: URL-safe (- and _) for tokens and URLs, Keep = padding to include or drop the trailing equals signs, and Data URL to add the data: prefix with the right media type.
- To decode, paste Base64 or a full data URL. Padding is optional and spaces or line breaks are ignored.
- Read the result in the Output box. For an image, check the Image preview. For other data, use Download as file to save the decoded bytes.
- Use Copy to put the result on your clipboard.
Features
- Encodes and decodes text as UTF-8, so every language and emoji works.
- Encodes any file or image from your device. It is read in your browser and never uploaded.
- URL-safe option that uses - and _ in place of + and /, as used by JWT and URL parameters.
- Padding switch: keep the trailing = signs or drop them.
- Data URL option that writes data:text/plain;charset=utf-8;base64, or data: with the file media type in front of the result.
- Decoder that accepts both alphabets, missing padding, whitespace and a data: prefix.
- Image preview when the decoded bytes are a PNG, JPEG, GIF, WebP or BMP picture.
- Download of the decoded bytes as a file, for PDFs, images and other binary data.
- Clear errors: Input is not valid Base64, or Valid Base64 but the bytes are not UTF-8 text.
Worked examples
{"alg":"HS256","typ":"JWT"}, URL-safe, no padding gives eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9
The standard JWT header.
{"sub":"1234567890","name":"John Doe","iat":1516239022}, URL-safe, no padding gives eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ
A typical JWT payload.
subjects?_d>>>, URL-safe, no padding gives c3ViamVjdHM_X2Q-Pj4
Privacy: how it works
- Your text, files and images are processed by code in your browser tab. Nothing is sent to Ulkaa or to any other server, which you can confirm in the Network tab of your browser developer tools.
- That matters for Base64 in particular, because people often paste API keys, tokens and private images into these tools. Because there is no upload, there is nothing to leak, but remember that anything you paste into any web page is visible on your screen.
Tips
- If a decoded result looks like random symbols, the original was probably binary, such as an image or a PDF. Use Download as file instead.
- A string that starts with eyJ is very likely Base64 for a JSON object that begins with {". JWT parts do.
- Pasting a JWT part? The segments are URL-safe Base64 without padding. Decode each of the dot-separated parts on its own.
- To embed a small image in CSS or HTML, choose File or image, tick Data URL, and paste the result into src or url().
Frequently asked questions
Is it really free?
Yes. There is no price, no trial and no credit card. Ulkaa Tool does the work with your own device, so there is no server bill to pass on to you.
Do I need an account?
No. There is no sign-up and no login. Open the page and use it. An Ulkaa account is not needed for anything on this tool.
Does it run in my browser?
Yes. Your text and files are processed by code running in your browser tab, on your own device.
Is my data uploaded?
No. Your text and files are never sent to Ulkaa or to anyone else. You can check this yourself by watching the Network tab in your browser developer tools while you use the tool.
What is the difference between Base64 and Base64URL?
Base64URL replaces + with - and / with _, and usually drops the = padding. That makes the result safe in URLs and filenames without escaping.
How do I decode a JWT with this tool?
Split the token at the dots, then paste one segment, such as the second one, into Decode. The header and payload are Base64URL-encoded JSON. The third part is a binary signature and will not show as text.
Do I need the equals signs?
Not for decoding here, since missing padding is added back. Some systems expect them, and JWT does not use them. Use the Keep = padding option to match what your system wants.
More Base64 Encoder and Decoder pages
- Base64 Encoder and DecoderEncode text, files or images to Base64, or decode a Base64 string or data URL back to text, an image or a file.
- Text to Base64 EncoderType or paste text and get its Base64 encoding straight away.
- Base64 to Text DecoderPaste a Base64 string and read the text it holds.
- Image to Base64 ConverterPick an image and get its Base64 string or a data URL ready to paste into HTML or CSS.
- Base64 to Image DecoderPaste Base64 or a data URL and see the picture it contains.
- File to Base64 ConverterPick any file and get its contents as a Base64 string.