Skip to main content
Yoryantra
Home/Tools
← Back to Tools

JWT Base64URL Encoder Decoder

Decode JWT compact parts or encode UTF-8 data with RFC 4648 Base64URL rules.

Choose a Base64URL Task

Paste a JWT header, payload, signature-safe Base64URL value, or a full JWT separated by dots.

Options

Pretty JSON formats decoded or encoded JSON with indentation.

Output

JWT Base64URL output will appear here.
Encoding and decoding happen in this browser tab. Yoryantra does not send the pasted token, JSON, or text to its server. Avoid copying production credentials into screenshots, tickets, or shared devices after decoding them.

Base64URL is encoding, not JWT verification

JWT compact parts are Base64URL-encoded bytes separated by dots. Decoding those bytes can reveal a protected header or payload, but it does not prove who created the token, whether the signature is valid, whether the token is expired, or whether an application should trust any claim inside it.

Treat decoded claims as untrusted data until signature or authenticated-encryption verification succeeds under the protocol that issued the token.

Three compact parts and five compact parts mean different things

A compact JWS normally has three segments: protected header, payload, and signature. Compact JWE has five: protected header, encrypted key, initialization vector, ciphertext, and authentication tag. The binary signature, ciphertext, IV, and tag are not assumed to be UTF-8 text; binary segments are reported as byte data instead of being silently replaced with Unicode replacement characters.

Padding and the URL-safe alphabet

RFC 4648 Base64URL replaces + with - and / with _. JOSE compact serialization normally omits trailing = padding. Missing padding can be reconstructed from the segment length, but a length with remainder one modulo four is impossible and is rejected.

References: RFC 4648 §5, RFC 7515 (JWS), and RFC 7516 (JWE).

JSON text versus arbitrary payload bytes

JWT headers are JSON. Many JWT payloads are JSON too, but JOSE can carry other payload conventions, including detached content in profiles that define it. A non-JSON payload therefore is not automatically corrupt. The decoder keeps that distinction visible instead of calling every non-JSON compact segment invalid.

Safer handling of real credentials

Local browser processing avoids sending the token to Yoryantra, but the decoded text may still expose account identifiers, scopes, internal hostnames, or other sensitive claims on your screen and clipboard. Prefer test tokens when demonstrating behavior or sharing screenshots.