What can this encoder decoder convert?

It can encode and decode Base64 text, URL strings, HTML entities, and JWT header and payload segments.

Does the JWT viewer validate signatures?

No. The JWT viewer only decodes the header and payload for inspection. It does not verify the signature or prove that a token is trusted.

Is the conversion done in my browser?

Yes. The conversion logic runs in the browser and does not require an external API.

Free developer encoding tool

Base64 URL Encoder Decoder

Encode and decode Base64, URL strings, HTML entities, and inspect JWT header and payload data without sending text to an external API.

Base64
URL encode
HTML entities
JWT preview

Converted result

Output

Current modeBase64 encoded

Input length: 0 characters
Output length: 0 characters
Preview: Output will appear here.

Output text

Token helper

Decode JWT header and payload

Paste a JWT to inspect the decoded header and payload. This viewer does not validate the signature and does not prove the token is trustworthy.

JWT input

JWT statusPaste a JWT

Decoded header

Header output will appear here.

Decoded payload

Payload output will appear here.

JWT payloads are only encoded, not encrypted, unless a separate encryption layer is used. Never treat decoded payload data as proof of authenticity without signature validation.

How Base64 encoding works

Base64 turns bytes into a text-safe alphabet so data can travel through systems that expect plain characters. It is common in API payloads, email attachments, configuration snippets, images embedded in text, and authentication formats.

Base64 is not encryption. Anyone who has the encoded text can decode it. Use it for representation and transport, not for secrecy.

Encoding modes compared

Different encoding modes solve different transport problems. Choose the mode that matches where the text will be used.

Mode	What it does	Common use
Base64	Represents bytes as text	API fields, attachments, config snippets
URL encode	Escapes reserved URL characters	Query strings, redirect URLs, path parts
HTML escape	Displays markup characters as text	Showing code samples or literal markup
JWT decode	Reads header and payload	Token inspection, not signature validation

URL encoding and decoding

URL encoding changes spaces, punctuation, and non-URL-safe characters into percent-encoded sequences. This prevents query parameters, redirect URLs, and path fragments from breaking when they contain spaces or reserved symbols.

URL decoding reverses that process. If a decode operation fails, the input may contain an incomplete percent sequence or text that was not actually URL encoded.

HTML escape and unescape

HTML escaping converts characters such as less-than, greater-than, quotes, and ampersands into entities. This is useful when you need to display markup-like text as text instead of letting the browser interpret it as HTML.

Escaping is only one part of safe output handling. Application security depends on context, framework behavior, and proper server-side controls.

JWT decoding caution

A JSON Web Token usually contains a header, payload, and signature. The header and payload are Base64URL encoded, which means they are easy to decode for inspection. That does not mean the token is valid.

To trust a JWT, an application must verify the signature with the expected algorithm, key, issuer, audience, and expiration rules. This page is only a quick inspection helper.

Common JWT claim fields

JWT payloads often use short registered claim names. These fields are only meaningful after the token signature and expected issuer rules are verified by the application.

Claim	Meaning	What to check
`iss`	Issuer	Expected identity provider or service.
`sub`	Subject	User or entity the token describes.
`aud`	Audience	Application or API the token is meant for.
`exp`	Expiration	Epoch time when the token should expire.
`iat`	Issued at	When the token was created.

Do not use encoding for secrecy

Encoding changes representation. Encryption protects content with a key. Hashing creates a one-way fingerprint. These are different tools, and mixing them up can create serious security mistakes.

Do not paste production secrets, passwords, private keys, session cookies, or live access tokens into general web utilities. Use approved internal tooling for sensitive material.