Base64 vs Base64URL: What's the Difference?
Base64URL is a URL-safe variant of standard Base64 encoding. It differs in two ways:
| Character | Standard Base64 | Base64URL |
|---|---|---|
| 62nd character | + | - |
| 63rd character | / | _ |
| Padding | = (required) | Usually omitted |
The characters + and / have special meaning in URLs
(they can be interpreted as a space or a path separator), and = is
used for query string key-value separation. Replacing these characters and
dropping padding means a Base64URL string can be placed directly into a URL path,
query parameter, or filename without any additional encoding.
Base64URL in JWTs (JSON Web Tokens)
A JWT consists of three Base64URL-encoded segments separated by dots:
header.payload.signature. Each segment is a JSON object (or binary
signature) encoded with Base64URL - never standard Base64 - because the token
needs to travel safely inside HTTP headers, cookies, and URLs without further
escaping. Use this tool to decode a JWT segment and inspect its contents, or to
encode a payload before signing.
How Padding Removal Works
Standard Base64 pads its output with = characters so the total length
is always a multiple of 4. Base64URL typically removes this padding since the
decoder can recompute it from the string's length. This tool automatically strips
padding when encoding to Base64URL, and automatically restores it when decoding,
so you never need to think about it.
Frequently Asked Questions
JWTs travel through URLs, HTTP headers, and cookies. Standard Base64's + and / characters have special meaning in URLs, and = padding can interfere with query strings. Base64URL avoids all of this, making tokens safe to use as-is.
This tool does it automatically - encoding to Base64URL strips trailing = characters, and decoding restores the correct padding internally before processing.
Base64URL replaces + with - and / with _, and typically omits = padding, so the result is safe to use directly inside URLs, filenames, and query parameters without extra escaping.
Yes. This tool's decode mode accepts both standard Base64 and Base64URL input automatically. To produce Base64URL output, use encode mode, which always returns the URL-safe variant.