Encoders & Decoders — JWT, Base64, URL, Morse & Number Bases
Five encoders that turn data between representations — and, for JWTs especially, let you see what is actually inside.
5 tools · Reviewed by Mimamsa, Founder & Engineer, CodeLint.Dev
Encoding is not encryption, and conflating the two causes real incidents. Base64 and URL encoding exist to make arbitrary bytes survive a transport that only accepts a restricted character set. Neither provides any confidentiality whatsoever — anyone holding the encoded string can trivially recover the original.
That distinction matters most for JWTs. A JSON Web Token’s header and payload are Base64url-encoded, not encrypted: every claim inside is readable by anyone who has the token, including the browser it was sent to. The signature protects the token against modification, not against being read. Putting a user’s email, role, or internal identifiers in a JWT payload is publishing them, and the decoder here exists partly to make that concrete.
All five tools run locally in your browser. For the JWT decoder that is not a nicety but a requirement — pasting a live session token into a website that transmits it to a server hands over a working credential.
Web encodings
Numeric & symbolic
Encode or component-encode?
The most common URL-encoding bug is using the wrong one of these two, so it is worth being explicit:
| Operation | Leaves untouched | Use it for |
|---|---|---|
| Encode full URL | Reserved characters that structure a URL: : / ? # [ ] @ & = + $ , | Making an already-assembled URL safe to transmit, without destroying its structure |
| Encode component | Only unreserved characters: A–Z a–z 0–9 - _ . ! ~ * ' ( ) | A single query parameter value, a path segment, or anything containing & or = that must not be read as structure |
In-depth guides
Long-form articles covering the standards and formulas behind these tools.
Frequently asked questions
- Is Base64 a form of encryption?
- No, and treating it as one is a recurring source of security incidents. Base64 is a reversible representation with no key and no secret. Anyone with the encoded string recovers the original in one step. Use it to move binary data through text-only channels — never to hide anything.
- Can this tool verify a JWT signature?
- It decodes and displays the header and payload but does not verify the signature, because verification requires the signing secret or public key. Never paste a production signing secret into any website. Verify signatures in your own backend, where the key already lives.
- What is the difference between Base64 and Base64url?
- Base64url replaces the two characters that are unsafe in URLs and filenames — + becomes - and / becomes _ — and usually drops the = padding. JWTs use Base64url throughout, which is why pasting a JWT segment into a strict standard-Base64 decoder often fails on the final characters.
- Why does my decoded text show question marks or mojibake?
- That is a character-encoding mismatch rather than a decoding failure. The bytes came out correctly but are being interpreted as the wrong character set — typically UTF-8 bytes read as Latin-1. This tool decodes as UTF-8, which is the right choice for essentially all modern data.