Code Beautifier
Failed to decode Base64URL segment

Fix JWT "Failed to decode Base64URL segment"

One of the token's three segments is not valid Base64URL: it was truncated, wrapped across lines, URL-encoded, or padded with = signs. How to spot which.

Input that triggers it

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIx MjM0NTY3ODkwIn0.abc%3D
Open JWT Decoder on its own page
Sensitive tool. Nothing you enter here is saved or shared: no drafts, history, or links. Everything runs in this browser tab.

Local workspace

Named projects in IndexedDB · Local only — never synced to our servers. Worksp…

Open manager
Inputtext
json

What the error means

The token split cleanly into three parts, but one of them would not decode. JWT segments use Base64URL: the alphabet is A–Z, a–z, 0–9, -, and _, with no padding and no whitespace. Failed to decode Base64URL segment means a segment contained a character outside that alphabet, or its length made it impossible to decode into whole bytes.

The example has two such problems: a space in the middle of the payload, and %3D at the end of the signature, which is a URL-encoded = that should never be present in a JWT.

Why it happens

  • A line break or space inserted by a wrap. Email clients, chat windows, ticket systems, and terminals all wrap long tokens. The break becomes part of the pasted text.
  • URL-encoding. A token that travelled in a query string may have - turned into %2D or = into %3D, and sometimes + or / from a tool that used standard Base64 by mistake.
  • Standard Base64 instead of Base64URL: + and / in a segment. Some libraries, and many hand-rolled encoders, get this wrong.
  • Truncation that cuts a segment to a length that cannot represent whole bytes.
  • Trailing padding (=) added by a tool that pads by default.

How to fix it

  1. Paste the token into the decoder above. The error names which segment failed — header, payload, or signature — which narrows the search.
  2. Remove every space and line break; the token must be a single unbroken string.
  3. If the text contains %, URL-decode it first. Base64 Encode/Decode in URL-safe mode shows whether a single segment decodes on its own.
  4. Replace + with - and / with _ if the producer used standard Base64; drop any trailing =.
  5. Decode again.

If it still fails

  • Run the token through String Inspector. Zero-width characters, non-breaking spaces, and typographic dashes (– instead of -) are invisible in most editors and each breaks the alphabet check.
  • If only the signature fails and the header and payload decode, the token is usable for inspection; the signature is opaque bytes and does not have to decode to text. A verifying server, however, will reject it if the bytes were altered.
  • Nothing pasted here is stored: the decoder runs in sensitive mode with no drafts, history, or share links.

Related errors