Blog · Encoding Comparison

Base64 vs Base64URL: What's the Difference?

Two characters and some padding. That is the entire difference. But it matters a lot when you are working with URLs, JWTs, and API tokens.

You are debugging a JWT token, or passing encoded data in a URL query string, and the standard Base64 decoder chokes on it. Chances are you are looking at Base64URL, not standard Base64. Here is what changed and why.

The Difference: 2 Characters

Standard Base64 (RFC 4648 section 4) uses 64 characters: A-Z, a-z, 0-9, +, and /. It also adds = padding to make the output length a multiple of 4.

Base64URL (RFC 4648 section 5) makes three changes:

  • + becomes - (plus is a space in URLs)
  • / becomes _ (slash is a path separator in URLs)
  • = padding is often omitted (equals is a query param delimiter in URLs)
FeatureBase64Base64URL
Chars 62-63+ /- _
Padding= (required)= (optional)
URL SafeNoYes
Used InEmail, data URIs, filesJWTs, OAuth, URL params

Converting Between the Two

Base64URL to standard Base64 (for decoding):

const base64 = base64url
  .replace(/-/g, '+')
  .replace(/_/g, '/')
  .padEnd(base64url.length + (4 - base64url.length % 4) % 4, '=');

const decoded = atob(base64);

Standard Base64 to Base64URL (for URLs):

const base64url = encoded
  .replace(/\+/g, '-')
  .replace(/\//g, '_')
  .replace(/=+$/, '');

Our Tool Handles Both Automatically

Our Base64 encoder and decoder auto-detects whether your input is standard Base64 or Base64URL. It checks for - and _ characters and handles the conversion automatically. Paste either format and it just works.

Ready to encode or decode?

Our tool auto-detects Base64 and Base64URL. No setup needed.

Open Base64 Tool