How to Decode Base64 to JSON
Paste the encoded payload and select Decode. The bytes are decoded as UTF-8 and parsed as JSON before pretty printing. If the text is not valid JSON, the tool reports that distinction instead of presenting arbitrary text as a JSON document.
Recognizing Base64-Encoded JSON
Encoded JSON often decodes to an object or array, but a prefix is not a reliable validator. Base64 can represent any byte sequence. Decode the full payload, then validate its actual content.
Base64URL and JWT Payloads
JWT header and payload segments use Base64URL. Decode a single segment here or use JWT Decoder for the whole token. A successfully parsed payload does not verify a signature or establish that claims are trustworthy.
Validating Decoded JSON
Pretty printing confirms that the decoded text parses. It does not establish required fields or application-level validity. Use JSON Schema Validator when a data contract needs to be checked.
Common Decode Errors
A decoding error differs from a JSON parse error: one concerns Base64 or UTF-8, the other JSON syntax. Check missing characters, wrapper prefixes and the selected segment. Some Base64 strings simply do not contain JSON.
More examples and technical details
When You Need Base64 to JSON
Most people arrive at this conversion for one of three reasons: they are inspecting a JWT payload during authentication debugging, they have received an API response whose body or cursor is an opaque encoded blob, or they are reading a configuration value that was flattened into a single line so it could live in an environment variable. In every case the underlying content is ordinary JSON that was wrapped for transport.
The tell is almost always the same. A long string of letters and digits that starts with eyJ is Base64 encoded JSON, because the opening brace and quote of a JSON object always encode to that prefix. Once decoded, formatting the result makes nested claims and arrays readable at a glance.
Reading a JWT Payload
A JSON Web Token is three segments joined by dots. The first two are Base64URL encoded JSON and can be read by anybody. The third is a cryptographic signature over the first two and is meaningless as text.
- Copy the token and locate the two dot separators.
- Take the middle segment, the text between the two dots.
- Decode it as Base64URL to get the raw JSON claims object.
- Format the JSON and read the claims, starting with exp and aud.
Base64URL: What Changes
JWT segments use the URL and filename safe alphabet, so a strict standard decoder can reject them. Three differences matter:
Common Claims You Will See
RFC 7519 registers a small set of claim names. Everything else in a payload is application specific, such as email, roles, scope, or tenant.
| Claim | Name | Meaning |
|---|---|---|
| iss | Issuer | Identifies the party that created and signed the token. |
| sub | Subject | The principal the token is about, usually a user id. |
| aud | Audience | The recipients the token is intended for. Reject if you are not listed. |
| exp | Expiration time | Unix timestamp after which the token must be rejected. |
| nbf | Not before | Unix timestamp before which the token must be rejected. |
| iat | Issued at | Unix timestamp recording when the token was created. |
| jti | JWT ID | Unique identifier, useful for replay detection and revocation lists. |
The time based claims (exp, nbf, iat) are Unix timestamps in seconds, not milliseconds. A value like 1735689600 is January 1, 2025. Multiplying by 1000 before feeding it to a JavaScript Date is a step people forget constantly.
Decoding Is Not Verifying
The Base64 Alphabet
Every 6 bit group produces a value between 0 and 63, and that value is looked up in the table below. RFC 4648 fixes this ordering: uppercase letters first, then lowercase, then digits, then the plus and slash characters. The padding character (=) is not part of the alphabet, it only marks the end of an incomplete group.
| Index | Char |
|---|---|
| 0 | A |
| 1 | B |
| 2 | C |
| 3 | D |
| 4 | E |
| 5 | F |
| 6 | G |
| 7 | H |
| 8 | I |
| 9 | J |
| 10 | K |
| 11 | L |
| 12 | M |
| 13 | N |
| 14 | O |
| 15 | P |
| Index | Char |
|---|---|
| 16 | Q |
| 17 | R |
| 18 | S |
| 19 | T |
| 20 | U |
| 21 | V |
| 22 | W |
| 23 | X |
| 24 | Y |
| 25 | Z |
| 26 | a |
| 27 | b |
| 28 | c |
| 29 | d |
| 30 | e |
| 31 | f |
| Index | Char |
|---|---|
| 32 | g |
| 33 | h |
| 34 | i |
| 35 | j |
| 36 | k |
| 37 | l |
| 38 | m |
| 39 | n |
| 40 | o |
| 41 | p |
| 42 | q |
| 43 | r |
| 44 | s |
| 45 | t |
| 46 | u |
| 47 | v |
| Index | Char |
|---|---|
| 48 | w |
| 49 | x |
| 50 | y |
| 51 | z |
| 52 | 0 |
| 53 | 1 |
| 54 | 2 |
| 55 | 3 |
| 56 | 4 |
| 57 | 5 |
| 58 | 6 |
| 59 | 7 |
| 60 | 8 |
| 61 | 9 |
| 62 | + |
| 63 | / |
Working on something related? Browse every free developer tool on the site, including a JWT decoder, JSON formatter, JSON to Base64 encoder, and URL decoder. Everything runs entirely in your browser, so nothing you paste is ever uploaded.
Standards and references
Frequently asked questions
How do I decode Base64 into JSON?
Paste the Base64 payload and use Decode; valid JSON is printed readably.
Can this inspect JWT payloads?
It can inspect an individual encoded JSON segment. Use JWT Decoder for a complete token.
What if the decoded value is not valid JSON?
It reports invalid decoded JSON; use the general Base64 decoder if ordinary text is expected.
Does it support Base64URL?
Yes. URL-safe characters and omitted padding are normalized.
Is data uploaded?
No. Input is processed in this browser tab and is not uploaded by the tool. Copy and download are actions you control; ordinary page analytics do not receive tool input.