Base64 vs Base64URL: What's the Difference?

Back to Base64 Encode Decode Tool

If you have ever worked with JWT tokens, URL parameters, or API authentication, you have likely encountered both Base64 and Base64URL encoding. While they are very similar, the differences matter a lot depending on where you use them.

What is Standard Base64?

Standard Base64 (RFC 4648 section 4) is the most common encoding format. It uses a 65-character alphabet consisting of:

• A-Z (26 characters)
• a-z (26 characters)
• 0-9 (10 characters)
• + (plus sign)
• / (forward slash)
• = (padding character)

This is what you get when you run btoa() in the browser or base64.b64encode() in Python.

What is Base64URL?

Base64URL (RFC 4648 section 5) is a URL-safe variant of Base64. It was designed specifically for use in URLs, filenames, and anywhere else where certain characters have special meaning.

Base64URL makes three changes to standard Base64:

• + becomes - (minus sign) - because + means space in URL query strings
• / becomes _ (underscore) - because / is a path separator
• = padding is stripped - because = is used for query parameters and makes the string longer

Side by Side Comparison

Feature	Standard Base64	Base64URL
Character 62	+	-
Character 63	/	_
Padding	= added	Stripped
URL safe	No	Yes
Filename safe	No	Yes
RFC	RFC 4648 sec 4	RFC 4648 sec 5
JS function	btoa()	Custom (see below)
Used in	Email, data URIs, Basic Auth	JWT, URL params, OAuth tokens

Real-World Example

Let us encode the string Hello, World! How are you? in both formats:

Standard Base64

SGVsbG8sIFdvcmxkISBIb3cgYXJlIHlvdT8=

Notice the = padding at the end, and all characters are URL-safe in this particular example. Now let us try a string that contains binary data:

Base64URL Example

When standard Base64 encodes binary data, it often produces + and / characters. For example, encoding 3 bytes [0x3E, 0xBF, 0x1A]:

• Standard Base64: Pr8a (no URL-unsafe chars here either)
• With more complex binary: Standard produces Pj+/Gg== which contains + and / and =
• Base64URL version: Pj-_Gg (+, / replaced; padding stripped)

Why Base64URL Matters for JWT

JWT (JSON Web Token) is the most common use case for Base64URL. A JWT consists of three Base64URL-encoded segments separated by dots:

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.dozjgNqPZAmYgCgP

If standard Base64 were used instead, the tokens would break when used in URL query parameters or HTTP headers. The + would be interpreted as a space, and / would confuse URL path parsers.

How to Convert Between Base64 and Base64URL

You can use our Base64 Encode Decode tool which supports both Standard Base64 and Base64URL modes. Simply switch the mode pill at the top of the tool.

In JavaScript, converting between them is straightforward:

// Standard to Base64URL
function toBase64URL(b64){
    return b64.replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
}

// Base64URL to Standard
function fromBase64URL(b64url){
    var str = b64url.replace(/-/g, '+').replace(/_/g, '/');
    while(str.length % 4) str += '=';
    return str;
}

// Encode directly to Base64URL
function encodeBase64URL(str){
    var bytes = new TextEncoder().encode(str);
    var binary = String.fromCharCode.apply(null, bytes);
    return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
}

In Node.js:

// Encode to Base64URL
var b64url = Buffer.from('Hello, World!').toString('base64')
    .replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
// "SGVsbG8sIFdvcmxkIQ"

// Decode from Base64URL
var decoded = Buffer.from(b64url, 'base64').toString();
// "Hello, World!"

In Python:

import base64

# Encode to Base64URL
b64url = base64.urlsafe_b64encode(b"Hello, World!").decode().rstrip('=')
# "SGVsbG8sIFdvcmxkIQ"

# Decode from Base64URL
decoded = base64.urlsafe_b64decode(b64url + '==').decode()
# "Hello, World!"

When to Use Each

Use Standard Base64 when:

• Embedding images as data URIs in HTML/CSS
• Encoding email attachments (MIME)
• Storing binary data in JSON (the + and / are escaped)
• Working with legacy systems that expect standard Base64

Use Base64URL when:

• Creating JWT tokens (JSON Web Tokens)
• Passing encoded data in URL query parameters
• Creating OAuth tokens and API keys
• Generating short, filename-safe identifiers
• Any situation where +, /, or = would cause problems

Summary

The difference between Base64 and Base64URL is small but critical. By swapping just two characters (+/- and //_) and removing padding, Base64URL makes encoded data safe for URLs, filenames, and JWT tokens. Standard Base64 remains the right choice for data URIs, MIME email, and general binary-to-text conversion.

Try both modes with our free Base64 encoder/decoder that supports Standard Base64 and Base64URL side by side.