Paste a JSON Web Token to decode it. The header and payload are shown as JSON, the iat, nbf and exp claims as dates with an expiry check, and unsigned tokens (alg: none) are flagged. The token never leaves your browser, so production tokens are safe to paste.
Encode a file:
A JWT is three Base64url strings joined by dots: header (the signing algorithm, alg, and often typ and a key id, kid), payload (the claims: sub for the user, iat issued-at, nbf not-before and exp expiry, all in Unix seconds, plus whatever the issuer adds) and signature. The first two parts are only encoded, not encrypted: anyone holding the token can read them, so a JWT should never carry passwords or secrets.
JWT parts use the URL-safe Base64 alphabet (- and _ instead of + and /) with the = padding removed, and their JSON is UTF-8. General-purpose decoders trip on each of these. Measured on the payload of the example token above (113 characters, with a _ and the name Zoë):
atob(payload) throws InvalidCharacterError because of the _. Swapping -_ for +/ first makes it work, but then the name comes out as Zoë Ng: atob returns Latin-1, so decode the bytes with TextDecoder.base64.b64decode(payload) fails with number of data characters (113) cannot be 1 more than a multiple of 4 (it skips the _), and base64.urlsafe_b64decode(payload) fails with Incorrect padding. Add the padding: urlsafe_b64decode(p + '=' * (-len(p) % 4)).base64_decode($payload) returns 84 bytes of garbage with no error, again skipping the _, and json_decode then returns NULL. Use base64_decode(strtr($p, '-_', '+/')).Buffer.from(payload, 'base64') decodes it correctly: it accepts both alphabets and missing padding.This page reads the token; it does not check the signature, because that needs the issuer's secret (HS256) or public key (RS256, ES256). Anyone can create a token with any payload, so a server must verify the signature with a JWT library before it trusts a single claim, and should only accept the algorithms it expects. A header of {"alg":"none"} means the token is unsigned (RFC 7519 calls it an Unsecured JWT); servers that accepted it were a classic JWT vulnerability, which is why this page flags it.
The decoder also takes plain Base64 and Base64url. Switch the mode to encode text, or see the Base64 decoder for files and images.
Shotmint is a screenshot and PDF API. POST https://shotmint.creasework.com/v1/pdf with {"html": "…"} returns a PDF, and /v1/screenshot returns a PNG of any URL or HTML, rendered in real Chromium (1 credit each; 25 free renders a month, then €5 for 2,000 that never expire). Add response=url to get a link instead of the bytes, or put the URL in a query string with the encoding above. Scripts, AI agents and Make or Zapier can get a key with a bare POST https://shotmint.creasework.com/v1/keys/free (no body, JSON reply); request bodies are described in openapi.json.
Get 25 free renders a month API docs
Is my text uploaded? No. Encoding and decoding run in your browser and nothing is sent to a server, so tokens, API keys and private data stay on your device.
Is Base64 encryption? No. Anyone can decode it; it only turns bytes into text that survives email, JSON and URLs, and makes the data about 33% bigger.
Related tools: Base64 encoder, Base64 decoder, URL encoder, URL decoder, Text to hex converter, Hex to text converter, HTML encoder, HTML entity decoder, JSON formatter, Image to Base64, Base64 to image.