Base64 to JSON: How to Decode Cookie and Session Data Safely

You have a long, unreadable string of letters and numbers that is supposed to hold cookie or session data, and you need base64 to json conversion so you can actually read it. Maybe a seller, a browser extension or an import panel handed it over, and you want to see its fields before you feed it to another tool.

This guide shows how to recognise a Base64 string, decode it into pretty-printed JSON with a free tool, fix the errors that usually appear, and encode JSON back to Base64 when a panel asks for that format. It also covers keeping the decoded data private, because cookie and token values are sensitive.

What Base64 is and why cookies and tokens get wrapped in it

Base64 writes any data, including text with quotes, braces and non-English letters, using only 64 safe characters: A to Z, a to z, 0 to 9, plus the symbols + and /. Systems that cannot cope with raw punctuation or line breaks can still carry the data, because Base64 turns everything into plain, copy-friendly text.

That is why you meet a cookie base64 string in practice. A tool that exports session data as JSON may wrap it in Base64 so it travels through a text box, a URL parameter or a chat message without breaking, and an import panel may expect the same wrapping on the way in.

Importantly, Base64 is an encoding, not encryption. There is no password and no key, and anyone holding the string can turn it back into the original text, so treat the string as if it were the data itself.

How to recognise a Base64 string

Before you decode anything, check that the string really is Base64. Three quick checks usually settle it.

The character set

A standard Base64 string contains only letters, digits, + and /. If you see colons, spaces between words or at signs, it is probably something else. Delivery lines such as username:password:email:email_password:auth_token are colon-separated text, not Base64, and no decoder will make sense of them.

The padding

Base64 works in groups of four characters. When the data does not fill the last group, one or two equals signs are added as padding. A string ending in = or == is a strong hint, but strings without an equals sign are valid when their length happens to fit, and some tools strip the padding on purpose.

The telltale start

A JSON object begins with a brace and a quote, and that pair always encodes to the same opening. A string starting with eyJ is almost always a JSON object, W3si usually means a list of objects, and WyJ a list of text values. If your string opens that way, decoding it should give you JSON.

Not sure? Paste a sample into the identify format tool. It checks the alphabet, padding and length, and tells you whether the text looks like Base64, JSON or something else.

Base64 to JSON: decode it with the free tool

The Base64 to JSON tool does the whole job in your browser, and nothing is uploaded, so the string stays on your device.

• Paste the Base64 string into the input box. Use the example button first if you want to see what a correct result looks like.
• The result appears instantly. If the decoded text is valid JSON, it is pretty-printed with two-space indentation, so nested fields are easy to scan.
• Read the structure, then use the copy button to take the JSON with you.

The tool strips spaces and line breaks before decoding and reads the bytes as UTF-8, so accented letters and non-Latin scripts come out correctly instead of as garbled symbols. As a test, paste eyJ1c2VyIjoiaGVzYXAxIiwidG9rZW4iOiJhYmMxMjMifQ== and you will get an object with a user field and a token field.

If the decoded text is readable but not JSON, the tool shows it as plain text rather than throwing the result away. That is common with a bare token, and it is still a successful decode.

Fix decode errors: padding, line breaks and the URL-safe variant

When a decode fails, the cause is almost always one of these.

Missing padding

The string was cut or had its equals signs removed. Compare eyJpZCI6MX0= with eyJpZCI6MTIzfQ==: the first needs one equals sign, the second needs two. Add = until the length is a multiple of four. The exception is a string that leaves a remainder of one when divided by four: no padding fixes that, because characters were lost when it was copied, and you need a fresh copy of the original.

Line breaks and stray spaces

Email clients, chat apps and text files often wrap long strings across lines. Those breaks are not part of the data. The tool removes them for you, but other decoders may not.

The URL-safe variant

Strings built for web addresses swap + for - and / for _ so they survive inside a link, and a standard decoder rejects those two characters. Replace every - with + and every _ with /, restore the padding, and decode again.

Account lines pasted by mistake

If you pasted rows of colon-separated delivery data, the tool will say it looks like an account list. That text needs a column splitter, not a decoder. Use split by delimiter to pull out the fields you need.

JSON to Base64 encode: convert it back for tools that expect it

Some panels and import tools want session data as Base64 instead of raw JSON. The JSON to Base64 tool handles that direction. Paste your JSON, choose a single-line compact output or an indented readable one, and copy the result. The compact mode is the better default for most imports because it gives the shortest string.

The tool validates your JSON first, so a missing comma or an unclosed brace is caught before you encode a broken payload. Encoding uses UTF-8, which makes a round trip reliable: decode a string, change one field, encode it again, and every other field comes back exactly as it was.

If your cookies live in a Netscape-format text file, convert them with the Netscape cookies tool and follow our guide to converting Netscape cookies to JSON. If you work with an auth token instead, see logging in to Twitter with an auth token.

Handle decoded data privately

Decoded cookie and session data can contain tokens that work like a key to an account, so a few habits are worth keeping.

• Work locally. A browser-based tool that does not upload your input is a better fit than a random website that sends your text to a server you cannot inspect.
• Do not paste decoded values into public chats, tickets or screenshots. Share only field names when you ask for help.
• Keep the original string untouched, decode a copy, and delete working files when you finish.

For simple, repeatable conversions like these, a local converter is usually all you need. Our note on when a local format converter is enough explains how to decide. When you are ready to pick accounts, browse the aged account category, and use the free tools page for everything between delivery and login.

Frequently asked questions

How do I know a string is Base64?

Check three things: it uses only letters, digits, + and /, its length fits groups of four with optional = padding, and it often starts with eyJ when it holds a JSON object. The identify format tool automates the check.

Why does my Base64 decode to unreadable characters?

Either the data was never text, such as an image or compressed content, or it used a different character set. You also get garbage when the string is the URL-safe variant and was not converted first.

What does the equals sign at the end mean?

It is padding. Base64 encodes in blocks of four characters, and one or two equals signs fill the last block when the data runs short. They carry no information of their own.

Is Base64 a form of encryption?

No. Base64 only changes how data is written, and anyone can reverse it without a key. Protect a Base64 string the same way you would protect the readable data.

How do I convert JSON back to Base64?

Paste the JSON into the JSON to Base64 tool, pick compact or indented output, and copy the result. The tool flags invalid JSON before encoding.