Encoding tool

Base64 to JSON Converter

Free online Base64 to JSON converter. Decode any Base64 string to JSON and see it formatted and syntax-highlighted instantly. Perfect for inspecting JWT payloads and API tokens.

100% client sideInstant resultNo data sent

Base64 Input

0 chars

JSON Output

Result appears here...

When You Need Base64 to JSON

Most people arrive at this conversion for one of three reasons: they are inspecting a JWT payload during authentication debugging, they have received an API response whose body or cursor is an opaque encoded blob, or they are reading a configuration value that was flattened into a single line so it could live in an environment variable. In every case the underlying content is ordinary JSON that was wrapped for transport.

The tell is almost always the same. A long string of letters and digits that starts with eyJ is Base64 encoded JSON, because the opening brace and quote of a JSON object always encode to that prefix. Once decoded, formatting the result makes nested claims and arrays readable at a glance.

Reading a JWT Payload

A JSON Web Token is three segments joined by dots. The first two are Base64URL encoded JSON and can be read by anybody. The third is a cryptographic signature over the first two and is meaningless as text.

eyJhbGciOiJIUzI1NiJ9 . eyJzdWIiOiIxMjMifQ . dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk
  ^ header              ^ payload            ^ signature
 
header  decodes to  {"alg":"HS256"}
payload decodes to  {"sub":"123"}

Copy the token and locate the two dot separators.
Take the middle segment, the text between the two dots.
Decode it as Base64URL to get the raw JSON claims object.
Format the JSON and read the claims, starting with exp and aud.

Base64URL: What Changes

JWT segments use the URL and filename safe alphabet, so a strict standard decoder can reject them. Three differences matter:

1. index 62 is - instead of +
2. index 63 is _ instead of /
3. trailing = padding is normally stripped
 
Repair recipe before decoding:
  replace - with +
  replace _ with /
  append = until the length is a multiple of 4
 
length % 4 == 2  ->  add ==
length % 4 == 3  ->  add =
length % 4 == 1  ->  the string is malformed

Common Claims You Will See

RFC 7519 registers a small set of claim names. Everything else in a payload is application specific, such as email, roles, scope, or tenant.

Claim	Name	Meaning
iss	Issuer	Identifies the party that created and signed the token.
sub	Subject	The principal the token is about, usually a user id.
aud	Audience	The recipients the token is intended for. Reject if you are not listed.
exp	Expiration time	Unix timestamp after which the token must be rejected.
nbf	Not before	Unix timestamp before which the token must be rejected.
iat	Issued at	Unix timestamp recording when the token was created.
jti	JWT ID	Unique identifier, useful for replay detection and revocation lists.

The time based claims (exp, nbf, iat) are Unix timestamps in seconds, not milliseconds. A value like 1735689600 is January 1, 2025. Multiplying by 1000 before feeding it to a JavaScript Date is a step people forget constantly.

Decoding Is Not Verifying

Anyone can read a JWT payloadDecoding a token requires no key and proves nothing. The payload is encoded, not encrypted, so never store passwords, private keys, or sensitive personal data in it. Equally, never trust a decoded payload in application logic until the signature has been verified server-side with the correct key and the expiry has been checked.

The Base64 Alphabet

Every 6 bit group produces a value between 0 and 63, and that value is looked up in the table below. RFC 4648 fixes this ordering: uppercase letters first, then lowercase, then digits, then the plus and slash characters. The padding character (=) is not part of the alphabet, it only marks the end of an incomplete group.

Index	Char
0	A
1	B
2	C
3	D
4	E
5	F
6	G
7	H
8	I
9	J
10	K
11	L
12	M
13	N
14	O
15	P

Index	Char
16	Q
17	R
18	S
19	T
20	U
21	V
22	W
23	X
24	Y
25	Z
26	a
27	b
28	c
29	d
30	e
31	f

Index	Char
32	g
33	h
34	i
35	j
36	k
37	l
38	m
39	n
40	o
41	p
42	q
43	r
44	s
45	t
46	u
47	v

Index	Char
48	w
49	x
50	y
51	z
52	0
53	1
54	2
55	3
56	4
57	5
58	6
59	7
60	8
61	9
62	+
63	/

Working on something related? Browse every free developer tool on the site, including a JWT decoder, JSON formatter, JSON to Base64 encoder, and URL decoder. Everything runs entirely in your browser, so nothing you paste is ever uploaded.

Frequently asked questions

4 answers

What is this tool used for?

This tool is primarily used for inspecting JWT (JSON Web Token) payloads and debugging Base64-encoded API responses. Many authentication systems and APIs encode structured JSON data as Base64 to make it URL-safe or to fit it into a header field. Pasting the Base64 segment here reveals the underlying JSON in a readable, formatted view.

What happens if the decoded value is not valid JSON?

How do I decode a JWT payload with this tool?

Does decoding change the order of JSON keys?

More JSON Tools

About Base64 to JSON Decoding

Base64-encoded JSON is the foundation of JWT (JSON Web Tokens), a widely used standard for transmitting authentication and authorization data between services. A JWT payload segment is simply a URL-safe Base64-encoded JSON object containing claims. This tool makes it easy to inspect those claims without writing any code. It also handles API tokens, webhook signatures, and any other Base64 payload that wraps a JSON structure. Decoded JSON is displayed in a formatted, readable view so you can quickly identify the fields and values.