Base64URL to Text Converter
Encode text to URL-safe Base64 or decode it back, following the base64url alphabet from RFC 4648 section 5. The tool converts your input to UTF-8, uses - and _ instead of + and / and leaves out = padding unless you ask for it. When decoding it accepts padded and unpadded input. Developers use it for JWT parts, OAuth PKCE values, signed URLs and file names that must survive in links.
Frequently asked questions
What is Base64URL?
Base64URL is the URL and filename safe variant of Base64 defined in RFC 4648 section 5. It replaces + with - and / with _, so the output can appear in URLs and file names without escaping. Padding with = is usually omitted.
Can I see an example?
The text foobar encodes to Zm9vYmFy, the same as standard Base64. The text ??> encodes to Pz8- where standard Base64 gives Pz8+, and subjects?_d gives c3ViamVjdHM_X2Q. Decoding returns the original text.
Should I enable padding?
Leave it off for JWTs, PKCE code challenges and most web uses, which drop the = signs. Turn it on only if the receiving system expects a length that is a multiple of four. The decoder accepts both.
How do I decode a JWT with this tool?
Copy the header or payload part, the text between the dots, and decode it. You get the JSON. The third part is a binary signature, so the tool reports that it is not valid UTF-8 text.
Why is my input rejected?
Only A to Z, a to z, 0 to 9, - and _ with optional trailing = are valid. Standard Base64 characters + and / are refused, so use the Base64 Converter for those. A length that leaves a single character in the last group is also invalid.
Does the tool ignore whitespace?
Yes. Spaces, tabs and line breaks are removed before decoding, which helps with values copied from wrapped logs or emails.
How are special characters and emoji handled?
Text is encoded as UTF-8 before conversion, so any character, including emoji, round-trips exactly. Decoded bytes must form valid UTF-8 to be shown.
Is Base64URL secure for sensitive data?
No. It is only an encoding and offers no protection. A JWT payload, for example, is readable by anyone, which is why it must not contain secrets.
What is the size overhead?
Every 3 bytes become 4 characters, so encoded data is about 33 percent larger. Without padding the output is up to two characters shorter.
How much text can I convert?
Up to 5 MiB of text per request. The input is not stored.