Base64 vs Base64URL: URL-Safe Alphabet
Base64 (RFC 4648 §4) uses + and /. Base64URL (RFC 4648 §5) uses - and _ instead so the encoded string is safe in URLs and filenames. Standard Base64 keeps = padding; Base64URL often omits it. This comparison is not a converter. Encode on /base64/ or /base64url/.
Base64 encoding converts binary data to ASCII text using 64 printable characters. The standard alphabet works everywhere except URLs, where three of those characters have special meaning. Base64URL solves this with a URL-safe alphabet.
The character difference
Alphabet comparison
| Position | Base64 | Base64URL | URL Problem |
|---|---|---|---|
| 0–25 | A–Z | A–Z | None |
| 26–51 | a–z | a–z | None |
| 52–61 | 0–9 | 0–9 | None |
| 62 | + | - | Decoded as space in query strings |
| 63 | / | _ | Path separator |
| Padding | = | (omitted) | Query parameter delimiter |
Example: encoding the same bytes
The string >>>??? contains bytes that produce the problematic characters:
In a URL like example.com?data=Pj4+Pz8/, the + becomes a space and the / breaks the query string. Base64URL's Pj4-Pz8_ passes through unchanged.
When to use each encoding
Use Base64URL for
- ✓JWTs – header and payload are Base64URL-encoded
- ✓URL query parameters – state tokens, OAuth codes
- ✓Filenames – no forbidden characters
- ✓Cookies – avoids encoding issues
- ✓URL slugs and IDs – safe in paths
Use standard Base64 for
- ✓Email attachments – MIME requires standard alphabet
- ✓PEM certificates – defined format with padding
- ✓Data URIs –
data:image/png;base64,... - ✓JSON/XML payloads – not in URLs anyway
- ✓Legacy systems – may not support Base64URL
Converting between encodings
Converting Base64 to Base64URL (and back) is simple string manipulation:
// Base64 → Base64URL base64url = base64 .replace(/\+/g, '-') .replace(/\//g, '_') .replace(/=+$/, ''); // Base64URL → Base64 base64 = base64url .replace(/-/g, '+') .replace(/_/g, '/') .padEnd(base64url.length + (4 - base64url.length % 4) % 4, '=');
Most modern languages have built-in Base64URL support. In JavaScript, you can use the Base64URL encoder to test conversions.
Padding: to include or not?
Standard Base64 pads output with = to make the length a multiple of 4. Base64URL typically omits padding because:
- The
=character needs URL encoding - The original length can be calculated from the encoded length
- JWTs and most modern specs omit it
RFC 4648 section 3.2 explicitly allows omitting padding when the length is known. When decoding, most Base64URL implementations accept input with or without padding.
Try both encodings
Encode and decode text with both alphabets to see the difference. Nothing is uploaded.
FAQ
- What is the difference between Base64 and Base64URL?
- Base64 uses + and /. Base64URL uses - and _ instead, making it safe for URLs and filenames.
- When should I use Base64URL?
- Use Base64URL when the encoded string will appear in URLs, query parameters, or filenames.
- Is padding different?
- Base64URL often omits = padding since it can be calculated. Standard Base64 includes padding.
- Does this tool upload my data?
- No. All encoding runs in your browser using JavaScript. Nothing is sent to a server.