Base64 to JSON

Base64 to JSON decoder

The Base64 to JSON tool is built for the moment you find an opaque eyJ… string in a log, a cookie, a message queue or an API response and need to know what is inside. It decodes the Base64 (standard or URL-safe, with or without padding), parses the result as JSON and pretty-prints it with two-space indentation.

Example

Base64 input:

ewogICJpZCI6IDQyLAogICJuYW1lIjogIldpZGdldCIsCiAgInRhZ3MiOiBbIm5ldyIsICJzYWxlIl0KfQ==

Decoded JSON:

{
  "id": 42,
  "name": "Widget",
  "tags": [
    "new",
    "sale"
  ]
}

When the result is not valid JSON

The status bar tells you whether the decoded text is valid JSON. If it is not, you still see the decoded text along with the parser’s message, which usually points to one of these causes:

• Truncation. The Base64 string was cut short, so the JSON ends mid-value. For example, a value ending in …aWRnZXQi decodes to {"id":42,"name":"Widget" — valid so far, but missing the closing brace.
• It is not JSON. The data could be plain text, XML, a serialized object or binary data. Binary output is shown as a hex dump with a download option.
• Extra layers. Some systems compress before encoding. Base64 starting with H4sI is gzip; decompress it with Gzip Decompress first.

JWTs and other tokens

A JSON Web Token contains two Base64URL JSON segments separated by dots. You can paste one segment here, but the JWT Decoder handles the whole token and also converts expiry timestamps into dates. Keep in mind that decoding a token does not verify its signature.

Decoding in code

JSON.parse(atob(s)) works only for ASCII content and standard Base64. For UTF-8 text and Base64URL, use JSON.parse(Buffer.from(s, 'base64url').toString()) in Node.js, or json.loads(base64.urlsafe_b64decode(s + "==")) in Python (the extra padding is tolerated). This tool handles all of those cases without code.

Common places to find Base64 JSON

• Kubernetes secrets such as .dockerconfigjson.
• Cloud provider event payloads and message attributes.
• Session cookies and state parameters in web frameworks.
• Configuration exported by CI/CD systems.

Once decoded, you can edit the JSON and re-encode it with JSON to Base64. Decoding runs locally, but treat tokens and session cookies as sensitive: they may grant access to an account.

Recognizing Base64 JSON by its first characters

Because Base64 encodes three bytes at a time, the same opening characters always produce the same prefix. Learning a few of them lets you guess what a string contains before decoding it:

If a string starts with something else entirely, it may use a different encoding or be encrypted, and decoding it will only produce unreadable bytes.