Base64, URL Encoding and JWT Decoding: What Each Operation Means

A string full of percent signs, letters or dots can hide a simple formatting problem. Before decoding it, identify the representation and the context in which the result will be used.

FormatOwl's encoding tools operate on text locally. Use sample inputs while debugging and keep real access tokens out of screenshots or shared reports.

Choose the decoder by structure

Base64 represents bytes; it does not secure them

Base64 converts bytes into a restricted alphabet. FormatOwl's tool encodes UTF-8 text and decodes back to UTF-8, including Chinese characters. It is not a general binary-file decoder. MDN's Base64 overview explains the encoding.

Encoding Hello and decoding the result is a useful round-trip test. Encoding a password this way does not protect it; anyone with the encoded text can reverse the representation.

If the input is a data URL, its media-type prefix is part of that URL's wrapper rather than the Base64 text itself. Use the dedicated SVG data URL tool for supported SVG wrappers.

Encode a URL component, not every separator

Suppose a query value should be red & blue. Encoding the value produces red%20%26%20blue. That keeps the ampersand inside the value rather than treating it as a separator between parameters.

Encoding a whole URL with the component tool also escapes separators such as : and /. Use it for the value you are inserting, then assemble the URL in the appropriate context.

Repeated encoding turns an existing percent sign into %25. For example, encoding %20 again produces %2520. Decode only the number of layers the source actually uses. This tool does not automatically interpret form-style + as a space.

JWT decoding is only inspection

A signed compact JWT commonly has three dot-separated parts. FormatOwl reads the Base64url JSON header and payload, but it does not verify the signature, expiry or authorization. A visible claim such as a role is not evidence that the token is trusted.

The JWT specification defines claims such as exp and their processing requirements. A decoder's readable JSON does not perform those checks for the receiving application.

Use the viewer to inspect structure with a sample token. Authentication decisions belong to the system that verifies the token under its own rules.

Preserve the intended text context

Hex and binary tools show UTF-8 bytes, so one visible non-ASCII character can occupy more than one byte. Hex input must form valid bytes, and binary input must contain complete eight-bit groups that decode to valid text.

HTML entity decoding may restore markup characters. Do not assume that encoding or decoding makes arbitrary HTML safe to execute. For JSON string contents, use JSON string escaping instead; quotation and backslash rules are different.

Share a reproduction without sharing the token

For a bug report, replace real claims and identifiers with invented values and reproduce the same encoding problem. Decoding a production JWT locally does not make its readable payload safe to publish. Avoid including the original token in screenshots, issue descriptions or URLs.

When the decoded payload is ordinary JSON, use the JSON formatter for a small sample. Large exports have a separate file-based JSON workflow; neither formatting path verifies a token's signature or access rights.

Key takeaways

Identify the representation, transform one intended layer, and inspect the result in its destination context. Encoding is not encryption, and decoding is not validation of trust.