Base64URL

Base64URL (“base64 with URL and filename safe alphabet”, RFC 4648 section 5) is standard Base64 with two characters replaced:

In URLs, + can mean a space and / separates path segments, and both are invalid in file names on some systems. - and _ have no special meaning anywhere.

Padding

The RFC allows omitting = when the length is known from context, and almost every user of Base64URL does so (because = would need to be percent-encoded as %3D in URLs). Decoders should therefore accept values with and without padding.

Where it is used

• JSON Web Tokens (JWT): header, payload and signature are unpadded Base64URL. Decode one with the JWT decoder.
• WebAuthn / passkeys, OAuth PKCE code challenges, and many API keys.
• URL query parameters and short IDs (for example YouTube video IDs use the same alphabet).
• File names generated from hashes.

Converting

Example: +/+/ ⇄ -_-_; SGk (Base64URL) → SGk= (Base64).

Use the Base64URL encoder and decoder, or convert existing values with normalization.

Code

// JavaScript
const toB64Url = (b64) => b64.replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');

# Python
base64.urlsafe_b64encode(data).rstrip(b"=")

More examples: JavaScript, Python, PHP, Go.