Base64, URL encoding and JWT decoder

What it does

• Base64: text is turned into UTF-8 bytes and encoded as standard (+ /), URL-safe (- _) and unpadded Base64; any of these forms is accepted for decoding. If the decoded bytes are not UTF-8, no text is invented — only the hex bytes are shown.
• URL encoding: everything outside the RFC 3986 unreserved set (A–Z a–z 0–9 - . _ ~) becomes %XX. Form style writes spaces as +. A % not followed by two hex digits is reported with its position, not repaired.
• JWT: the header and payload of the three dot-separated parts are decoded, and iat, nbf and exp are shown in UTC and browser time with the current expiry status. The signature is not verified.

Examples

How the check was made

Before release 124 cases were compared with the Python 3 standard library, all matching: four Base64 forms and round trips for 29 texts (Korean, emoji, control characters, a BOM), results equal to urllib.parse.quote(s, safe='') and quote_plus, 9 non-UTF-8 byte strings, 12 HS256 JWTs made with hmac (payload values compared again with Python json — the big integer 12345678901234567890 keeps all its digits), and 29 broken inputs (wrong padding, bad characters, JWTs with the wrong number of dots …) that must all give an error.

Common mistakes

• Trusting a JWT because it decodes — anyone can write a header and payload. Verify the signature on the server with the key.
• Putting standard Base64 into a URL — + is read as a space in forms and / as a path separator. Use Base64url in URLs.
• JavaScript btoa('한글') — characters outside Latin-1 throw. Convert to UTF-8 bytes first.
• Treating encodeURIComponent as Python quote — encodeURIComponent leaves ! ' ( ) * as they are.