Base64url vs Base64: Safe Encoding for JWTs, Query Strings, and URLs

Why Standard Base64 Breaks URLs

When passing a standard Base64 string in an HTTP query parameter: ```text https://example.com/verify?token=a+b/c== ``` Two common errors occur during transmission: 1. **The '+' Character:** According to URL encoding rules, `+` in a query string represents an encoded space character. A receiving web server (such as Express, Django, or Spring) decodes `a+b` into `a b`, corrupting the cryptographic hash. 2. **The '/' Character:** In URL path parameters (`/api/verify/a+b/c==`), the forward slash is interpreted as a path delimiter, altering route resolution and triggering 404 errors.

The RFC 4648 §5 Base64url Specification To resolve these issues, **RFC 4648 Section 5** introduced the URL-and-Filename-Safe Base64 Alphabet: - Replace `+` with `-` - Replace `/` with `_` - Strip trailing `=` padding characters

Converting in JavaScript Converting between standard Base64 and Base64url requires only a couple of lines:

// Base64 to Base64url
function toBase64Url(base64) {
  return base64.replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');

// Base64url back to standard Base64 function fromBase64Url(base64url) { let base64 = base64url.replace(/-/g, '+').replace(/_/g, '/'); while (base64.length % 4) { base64 += '='; } return base64; } ```

All JSON Web Tokens (JWT) rely on Base64url to encode their header, payload, and signature into three period-separated segments. Convert and test your strings instantly using Mickytool's **Base64 Encoder / Decoder**.