URL-safe Base64

Standard Base64 uses + and / and = padding, which break in URLs. Base64URL swaps in - and _ and often drops padding.

How to use the URL-safe Base64

What does the URL-safe Base64 do?

Encode or decode Base64URL (RFC 4648 §5): + becomes -, / becomes _, padding optional; It applies this page-specific rule: encoding: UTF-8 bytes → standard Base64 → replace + with -, / with _, strip =.

Which inputs does this tool use?

To encode or decode base64url (rfc 4648 §5): + becomes -, / becomes _, padding optional, enter Plain text, Base64URL; keep every value in the same example; select Encode → when the values are ready; Start with a familiar case covered by this rule - This is what JWT payload segments and many signed cookies use - so the expected result can confirm the settings.

How should the tool result be read?

For a result intended to encode or decode base64url (rfc 4648 §5): + becomes -, / becomes _, padding optional, this is what JWT payload segments and many signed cookies use; read base64url together with the original plain text rather than as an isolated answer, and confirm that its units or structure match the intended use.

Is this encryption?

When the goal is to encode or decode base64url (rfc 4648 §5): + becomes -, / becomes _, padding optional, no.

Padding?

When using the page to encode or decode base64url (rfc 4648 §5): + becomes -, / becomes _, padding optional, output omits =.

Limits and accuracy

When using this tool to encode or decode base64url (rfc 4648 §5): + becomes -, / becomes _, padding optional, binary files are not handled; this is for text tokens; check the result in its intended destination before relying on it for important work; keep plain text until the output has been checked in its intended destination. For a repeatable check when you need to encode or decode base64url (rfc 4648 §5): + becomes -, / becomes _, padding optional, record Plain text alongside the final output and selected options. A known example using plain text can confirm how the page will encode or decode base64url (rfc 4648 §5): + becomes -, / becomes _, padding optional.

How this works

Encoding: UTF-8 bytes → standard Base64 → replace + with -, / with _, strip =. Decoding accepts both alphabets and missing padding.

This is what JWT payload segments and many signed cookies use. It is not encryption. Anyone can decode it.

Binary files are not handled; this is for text tokens. Huge pastes may hit browser memory limits.

Frequently asked questions

Is this encryption?

No. It is an encoding.

Padding?

Output omits =. Input may include it.

Unicode?

Text is UTF-8 encoded before Base64.