Base64 Decode JWT
Paste a JWT to instantly decode its Base64Url-encoded header and payload. Understand why Base64Url encoding is not encryption — and why JWTs should never contain sensitive secrets.
100% in-browser — nothing uploadedEncoded JWT
Decoded Header
Paste a token to decode this segment.
Decoded Payload
Paste a token to decode this segment.
Verify Signature
Features
100% private
Your token is decoded entirely in your browser. Nothing is uploaded, logged, or sent to any server or API.
Instant decoding
Paste a JWT and the header, payload, and claims are decoded in real time — no button required.
Human-readable claims
Standard claims like exp, iat, and nbf are explained and shown as readable dates with expiry status.
Signature verification
Verify HS256/384/512 with a secret, or RS, PS, and ES algorithms with a public key — all client-side.
How Base64Url encoding works in JWTs
JWTs encode their header and payload using Base64Url — a URL-safe variant of Base64 that replaces the + character with -, replaces / with _, and removes = padding characters. This makes the token safe to use in URLs and HTTP headers without percent-encoding. Crucially, Base64Url encoding is not encryption — it is trivially reversible by anyone who sees the token, with no key required.
This is why you should never put sensitive information in a JWT payload — passwords, private keys, credit card numbers, or secrets. The payload is publicly readable by anyone who possesses the token. The signature (third part of the JWT) is also Base64Url-encoded but contains a cryptographic value — however, being able to read it does not help an attacker forge signatures.
Paste a JWT above to instantly decode all three parts: the header JSON (algorithm and token type), the payload JSON (all claims), and the raw signature bytes. The tool shows the exact Base64Url-to-JSON decoding in real time — the same process your browser or server performs when reading a JWT.
Base64Url vs Base64
- Character 62
- Base64 uses '+'; Base64Url uses '-'
- Character 63
- Base64 uses '/'; Base64Url uses '_'
- Padding
- Base64 uses '='; Base64Url omits it
- URL safe?
- Base64: No (+ and / need escaping). Base64Url: Yes.
- Reversible?
- Both: Yes, with no key required.
- Is it encryption?
- No — never put secrets in a JWT payload.
How to decode a JWT token online
Paste your token
Copy a JSON Web Token and paste it into the encoded box. You can also load the example token to try it out.
Read the decoded data
The header and payload are decoded instantly. Switch to the Claims tab for plain-English explanations and expiry status.
Verify the signature
Enter the secret (HMAC) or public key (RSA/ECDSA) to confirm the token is authentic and hasn't been tampered with.