Base64 vs Base64URL: UTF-8, padding and round-trip checks
If encoded data fails inside a URL or decodes into unreadable text, check the variant and whether the bytes actually represent text. Fix the source, variant and expected output before running a round-trip comparison.
Open tool: Base64 encoder / decoder1. Establish a mixed-language baseline
Select standard Base64, encode the first line and compare with the second. Paste the second line back and decode it; punctuation, spacing and Chinese characters should be preserved. Do not encode both lines together.
Hello, 世界
SGVsbG8sIOS4lueVjA==2. Base64URL changes two alphabet characters
Standard Base64 uses + and /; Base64URL uses - and _. This tool also omits trailing = in Base64URL output. Some inputs use only letters and digits, so similar-looking output is not enough to identify the variant.
Repeat the experiment with the three question marks below to see / change to _. Enter only the text on the first line.
???
Base64: Pz8/
Base64URL: Pz8_3. Padding is structural, not arbitrary text
Trailing = relates to encoded length. The decoder checks the alphabet, length and padding. Missing characters or the wrong variant can cause errors; adding arbitrary = signs does not repair truncated data.
For JWT inspection, pass one header or payload segment to Base64URL decoding. A complete JWT includes periods and multiple segments; use the JWT tool for the whole token.
4. Valid Base64 need not decode to UTF-8 text
Images, compressed files and arbitrary binary data can all be Base64-encoded. This tool requires decoded output to be UTF-8 text, so valid binary encodings can be rejected without implying corrupt bytes.
The data:image/png;base64, prefix belongs to a Data URL, not the encoded body. Even without that prefix, PNG bytes are outside this text decoder’s intended input.
5. Verify the chain without treating it as encryption
Keep the original text, encode and decode it, then compare the result. If it travels through forms or URL parameters, also check whether + was interpreted as a space. Apply the appropriate URL encoding at the transport boundary.
Base64 uses no secret key; anyone with the encoded text can decode it. It addresses representation and transport, not password protection or encryption.