How Base64URL differs from Base64
Base64URL swaps `+` and `/` for `-` and `_`, which makes it safer inside URLs and tokens.
It also often drops padding, which is why copied JWT segments do not always decode cleanly in a plain Base64 tool.
Encode text to Base64URL or decode URL-safe Base64 back into readable UTF-8 text for JWT, callbacks, and transport-safe payloads.
Base64URL replaces + and / with URL-safe characters and usually omits trailing padding.
Yes.
Base64URL uses URL-safe characters and often removes trailing padding, which makes it common in JWTs and callback flows.
No. Encoding and decoding happen locally.
Yes. It works well for JWT header and payload segments.
No. Many systems omit trailing equals signs, so decoders often need to normalize the input first.
Only if the encoded value needs to be URL-safe. For general transport outside URLs, standard Base64 is usually enough.
Base64URL swaps `+` and `/` for `-` and `_`, which makes it safer inside URLs and tokens.
It also often drops padding, which is why copied JWT segments do not always decode cleanly in a plain Base64 tool.
JWT headers and payloads use Base64URL, and you will also see it in signed links and callback parameters.
It is the safer choice when an encoded value has to survive query strings, routers, and middleware without getting mangled.
A lot of Base64URL strings get copied out of tokens, cookies, or links after padding has already been stripped.
Normalizing them first helps you tell whether the problem is just formatting or whether the source value is actually broken.
These pages are meant to stay direct: input at the top, results immediately below, then the FAQ and related guides if you need more context.