Base64URL is the URL- and filename-safe variant of Base64 defined in RFC 4648 Section 5. It replaces the two non-URL-safe characters '+' and '/' with '-' and '_', and usually drops the '=' padding, so the result can be placed directly in URLs, query strings, and filenames without further escaping.

What is the difference between Base64 and Base64URL?

They encode the same bytes; only the last two alphabet characters differ. Standard Base64 uses '+' and '/' and keeps '=' padding. Base64URL uses '-' and '_' and typically omits padding. To convert standard to URL-safe: replace '+' with '-', '/' with '_', and strip trailing '='.

Are JWTs encoded with Base64URL?

Yes. A JWT's header and payload are Base64URL-encoded JSON, joined with dots and followed by a Base64URL signature. That is why JWTs contain '-' and '_' but never '+', '/', or '='.

Base64URL Encode & Decode

URL-safe Base64 (Base64URL, RFC 4648 §5) swaps +// for -/_ and drops = padding, so it drops straight into URLs, query strings, and filenames. Encode and decode below — it all runs locally.

What is Base64URL?

Standard Base64 uses + and / as its last two characters and pads with = — all three of which have special meaning in URLs and filenames. Base64URL (RFC 4648 Section 5) fixes this by using - instead of +, _ instead of /, and omitting the = padding. The encoded bytes are identical; only the alphabet changes.

Converting standard Base64 to URL-safe

If you already have a standard Base64 string, the conversion is a character swap:

urlsafe = standard.replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');

To go back, replace - → + and _ → /, then re-add = padding until the length is a multiple of 4. This tool does both automatically — paste either variant into the decoder and it just works.

Where Base64URL is used

JWTs / JOSE — a token's header and payload are Base64URL-encoded JSON, which is why JWTs contain - and _ but never +, /, or =.
URLs & query strings — pass binary or tokens without percent-encoding.
Filenames & cache keys — / would create directories; _ is safe.

Is this private?

Yes — encoding and decoding happen entirely in your browser. Nothing is uploaded, which matters since Base64URL strings are often JWTs containing identifiers.

Frequently asked questions

What is Base64URL?

The URL- and filename-safe Base64 variant (RFC 4648 §5): - and _ instead of + and /, usually with no padding.

What's the difference between Base64 and Base64URL?

Same bytes, different last two alphabet characters and padding. Swap +→-, /→_, and strip = to convert.

Does Base64URL use padding?

Usually no — it's commonly omitted (as in JWTs). Decoders restore it before decoding; this tool does that for you.

Are JWTs Base64URL?

Yes — JWT header, payload, and signature are all Base64URL-encoded.

Need standard Base64, images, or files?

The main base64.dev tool handles text, images, files, and standard Base64 with auto-detect.

Open base64.dev →