Base64URL (“base64 with URL and filename safe alphabet”, RFC 4648 section 5) is standard Base64 with two characters replaced:
| Value | Standard | Base64URL |
|---|---|---|
| 62 | + |
- |
| 63 | / |
_ |
In URLs, + can mean a space and / separates path segments, and both are invalid in file names on some systems. - and _ have no special meaning anywhere.
Padding
The RFC allows omitting = when the length is known from context, and almost every user of Base64URL does so (because = would need to be percent-encoded as %3D in URLs). Decoders should therefore accept values with and without padding.
Where it is used
- JSON Web Tokens (JWT): header, payload and signature are unpadded Base64URL. Decode one with the JWT decoder.
- WebAuthn / passkeys, OAuth PKCE code challenges, and many API keys.
- URL query parameters and short IDs (for example YouTube video IDs use the same alphabet).
- File names generated from hashes.
Converting
| From → to | Steps |
|---|---|
| Base64 → Base64URL | replace + with -, / with _, remove = |
| Base64URL → Base64 | replace - with +, _ with /, append = until the length is a multiple of 4 |
Example: +/+/ ⇄ -_-_; SGk (Base64URL) → SGk= (Base64).
Use the Base64URL encoder and decoder, or convert existing values with normalization.
Code
// JavaScript
const toB64Url = (b64) => b64.replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');# Python
base64.urlsafe_b64encode(data).rstrip(b"=")More examples: JavaScript, Python, PHP, Go.
评论 (0)
对“Base64URL”有疑问、想法或发现了 bug？欢迎留言评论、为工具评分或回复他人。
暂无评论，快来分享您的反馈吧！