Base64URL converter and decoder
Bidirectional conversion between base64url, base64 (standard), hex, and UTF-8 text. base64url is the form WebAuthn / JOSE / CTAP2 use everywhere.
How to use this tool
What it does
Encodes and decodes URL-safe base64 (RFC 4648 §5) — the unpadded, -_ alphabet WebAuthn, JWS and CTAP2 use.
When to use it
Use it when decoding a WebAuthn challenge, credential ID, or JWS segment that arrives URL-safe and would break a standard base64 decoder.
Worked example
Decode a WebAuthn challenge value straight from a JSON payload without first converting -_ back to +/.
Input
All representations
About base64url
base64url is the URL- and filename-safe variant of base64 (RFC 4648 §5). It replaces + with - and / with _, and drops trailing = padding. WebAuthn, JOSE (JWT/JWS/JWE), and CTAP2 use it for every binary field.
Spec
RFC 4648 §5.
Use
WebAuthn challenge, credentialId · JWS signatures · CTAP2 messages · OAuth2 PKCE.
Companion
Frequently asked questions
How does base64url differ from standard base64?
It swaps the two URL-unsafe characters: + becomes - and / becomes _. Padding with = is usually omitted as well, which is why a base64url string often has a length that is not a multiple of four.
Why does WebAuthn use base64url everywhere?
Because its binary fields travel in JSON and in URLs, where + and / need escaping. CTAP2 and JOSE made the same choice for the same reason.
Why does my string fail to decode?
Usually it is standard base64 being decoded as base64url, or the reverse — the give-away is a + or / in the input. Stray whitespace from copying is the other common cause.
Is base64url a form of encryption?
No. It is a reversible encoding with no key and no secrecy. Anyone can decode it, which is exactly what this tool does.
Does anything I paste leave my browser?
Nothing. The tool is entirely client-side: the page ships a static script, does no network calls, and never transmits what you paste. You can confirm it by opening the network tab, or by loading the page and then going offline.