✳ ENCODING · PRACTICAL GUIDE
Base64URL vs Base64: A Practical Guide for Developers
Learn what changes between Base64 and Base64URL, when to omit padding, how UTF-8 fits in and how to avoid decoding errors.
Try Base64 Encoder & Decoder ↗The problem: text in URLs is not always URL-safe
Base64 converts bytes into printable text. Most of the resulting alphabet works fine in HTTP query strings and URLs, but standard Base64 can include +, / and =. Those characters may carry special meaning in URLs and some transports. Base64URL swaps two characters and commonly omits padding so an encoded value can be carried in web-oriented formats without extra escaping.
Compare the two formats on an actual string
Enter Hello? in the Vyblet Base64 converter. Standard Base64 produces SGVsbG8/. Base64URL produces SGVsbG8_. The underlying bytes are exactly the same; only the printable alphabet changes. The two encodings must not be confused with encryption, hashing or compression.
How the alphabet differs
Standard Base64 uses A–Z, a–z, 0–9, plus + and /. Base64URL replaces + with - and / with _. Padding = is often omitted in the URL-safe form. An implementation may still have stricter requirements, so always follow the protocol you are integrating with.
Don't ignore the UTF-8 step
Base64 encodes bytes, not JavaScript characters. Unicode text needs a specified byte encoding such as UTF-8 before Base64. For example, Chinese, accented text and emoji require multiple bytes for some characters. In JavaScript, the direct browser btoa() function is not a generic Unicode-to-Base64 encoder. Vyblet uses UTF-8 conversion before encoding and checks for valid UTF-8 after decoding.
A safe debugging workflow
- Check whether the API expects ordinary Base64 or the URL-safe variant.
- Confirm whether padding is required, optional or forbidden.
- Confirm the input's character encoding; UTF-8 is typical for web text.
- Run a round-trip test with ASCII and with non-ASCII characters.
- Do not treat Base64 or Base64URL as secret storage. Anyone can decode them.
FAQ
Can I use Base64URL inside a JWT?
JWT segments conventionally use Base64URL without padding. Generating the string is not the same as creating or validating a JWT signature.
Will Base64URL make my data smaller?
No. Like standard Base64, it generally expands data. It mainly changes which characters appear in the encoded representation.
Why does my decoder reject a token?
Check for mixed alphabets, unexpected padding, invalid characters or non-text binary contents being interpreted as UTF-8.
Put the explanation into practice
Open the corresponding tool and test with a small, non-sensitive example.