Encoding & Escaping / Encoding & Escaping

Base64 in JSON

Base64 in JSON encodes arbitrary bytes into ASCII text so they can travel inside JSON, URLs and headers, and decodes them back. It covers the URL-safe variant used in tokens and can open the payload segment of a JWT to show what claims it carries.

How to use

1
Paste text or Base64
Drop in the text you want to encode, or an existing Base64 string you want to read back. The tool detects the direction and shows the other form live as you type.
2
Encode to Base64
Press encode to turn the text into Base64. This is what you use when binary or unusual characters must sit safely inside a JSON string, a URL query, or an HTTP header without breaking the surrounding syntax.
3
Decode Base64 back
Paste a Base64 value and decode it to recover the original bytes as text. If the content was not text to begin with, you will see its best-effort character representation rather than a meaningful string.
4
Try URL-safe and JWT modes
Switch to URL-safe Base64 for tokens and query strings, where the standard + and / would be misinterpreted. Or paste a JWT and decode just its middle payload segment to inspect the claims without verifying the signature.

Key facts

OverheadBase64 encodes three bytes into four characters, so the output is about 33% larger than the input.Source:RFC 4648
URL-safeRFC 4648 section 5 defines Base64url using - and _ instead of + and /, and permits omitting the = padding for use in URLs and filenames.Source:RFC 4648 §5
JWT structureA JWT is header.payload.signature; the payload is Base64url-encoded JSON carrying the claims, decodable by anyone without the key.Source:RFC 7519
Not encryptionBase64 is reversible without a key, so it provides no confidentiality. Sensitive data must be encrypted, not merely encoded.Source:RFC 4648

Frequently asked questions

What is URL-safe Base64 and when do I need it?

Standard Base64 uses the characters + and /, which are not safe inside a URL or a filename — + can mean a space and / is a path separator. RFC 4648 section 5 defines a URL-safe variant that swaps those two characters for - and _ and usually drops the = padding. Use it whenever the encoded value will live in a query string, a path segment or a JWT. The two variants encode the same bytes; only the alphabet differs.

How do I read a JWT payload?

A JWT has three parts separated by dots: header.payload.signature. The payload is the middle segment, Base64url-encoded JSON describing the claims — who the token is for, who issued it, when it expires. Paste the whole token (or just that segment) and decode it to see those claims as readable JSON. This shows what the token asserts; it does not verify the signature, so anyone can read a JWT, and you should never trust the claims without checking the signature server-side.

Is Base64 encryption?

No. Base64 is encoding, not encryption. It changes how bytes are represented so they fit in text, but it applies no key and no secrecy — anyone who has the string can decode it instantly. Treating Base64 as a way to hide data is a serious mistake; sensitive values must be encrypted, not merely encoded. The only thing Base64 protects against is a syntax break, not a reader.

Is my data uploaded?

No. Encoding and decoding run entirely in your browser; the value you paste is never sent to or stored on any server. You can decode a real token or a real payload locally without exposing it, which is useful precisely because tokens frequently carry identifying information such as user identifiers and expiry claims that you would not want copied into someone else's logs.

Related tools

JSON Formatter

Paste JSON to pretty-print it with consistent indentation, minify it to one line, or find the exact line and column of a syntax error. Runs locally.

JSON Escape and Unescape

Escape text into a valid JSON string literal and unescape it back, and see why hand-writing escapes breaks on control characters. Runs locally.

Query String to JSON

Convert a URL query string to JSON and back, preserving repeated keys as arrays and showing how plus signs and percent-encoding differ. Runs locally.