atob() can't decode a JWT — the Base64URL gotcha (and the fix)

Short summary

JWTs and OAuth tokens use Base64URL encoding, not standard Base64: - becomes +, _ becomes /, and padding = is dropped. This breaks atob() which only understands standard Base64. Fix: replace - with +, _ with /, re-add = padding until length is multiple of 4, then decode. Use Buffer.from(str, 'base64url') in Node or the provided helper function for browsers.

• •Base64URL (used in JWTs) swaps + for -, / for _, and drops = padding
• •atob() fails on Base64URL because it only understands standard Base64
• •Solution: restore padding and swap alphabet back before decoding, or use Buffer in Node

Generated with AI, which can make mistakes.