Base64 vs Base64URL
Summary
Definition: Base64 and Base64URL are ASCII encodings for binary data.
Why it matters: URL-safe output prevents broken URLs and token parsing errors.
Pitfall: Incorrect padding or characters cause decode failures.
Base64 and Base64URL encode binary data as text. Base64URL modifies two characters
so the output is safe inside URLs and token formats like JWT. The data is the same,
but the alphabets and usage rules differ.
- Base64
- ASCII encoding using A-Z, a-z, 0-9, +, and / with optional padding.
- Base64URL
- URL-safe Base64 using - and _ instead of + and /.
- Padding
- Trailing = characters used for 4-byte alignment.
- JWT
- Token format using Base64URL-encoded segments.
Why Base64URL exists
Standard Base64 includes + and /, which are reserved characters in URLs.
Base64URL avoids these characters so encoded data survives transport unchanged.
Base64 vs Base64URL differences
The encoding alphabet is defined by RFC 4648. Padding rules are set by the consuming protocol.
Common mix-up: Base64 is an encoding, not encryption, and does not hide data.
Padding rules
Padding aligns output to a multiple of four characters.
Some protocols require padding, while others forbid it.
JWT compact serialization forbids padding characters.
Character sets
| Variant | Alphabet |
|---|---|
| Base64 | A-Z a-z 0-9 + / |
| Base64URL | A-Z a-z 0-9 - _ |
Example
Illustrative example showing URL-safe character changes.
Base64: ab+c/def==
Base64URL: ab-c_defThis example is schematic and not the result of encoding real binary data.
Tools
- Use Base64URL Encode/Decode for tokens and URLs.
- Use Base64 Encode for general encoding.
- Use Base64 Decode to inspect data.
Practical check
- Encode data with the required Base64 variant.
- Verify padding rules from the protocol spec.
- Decode and confirm the original bytes match.
FAQ
Is Base64URL the same as Base64? They encode the same data, but use different characters and protocol rules.
Do JWTs require Base64URL? Yes. JWT compact serialization requires Base64URL without padding.
Does Base64 hide data? No. Base64 is reversible and provides no confidentiality.