The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Base64 is not automatically safe to paste into every URL. Standard Base64 uses + and /, characters that have special meanings in URI syntax. The URL-safe variant, called base64url in RFC 4648, replaces + with - and / with _. Padding with = is a separate decision: retain it or omit it only when the protocol that carries the value explicitly allows that form.
What “URL safe” means
A value is URL-safe only in relation to a particular URL component and protocol. A string that works in a query parameter may need different handling in a path segment, fragment, cookie, authorization field, or signed token.
URI syntax reserves characters for structure. In RFC 3986, - and _ are unreserved, while = and + are reserved characters and / is a delimiter. Percent-encoding represents an octet when its character is outside the component’s allowed set or is being used as a delimiter inside that component.
Therefore, ordinary Base64 can be transported in a URL only when it is correctly percent-encoded and decoded in the right place. Base64url avoids the two most troublesome alphabet characters, but it does not override the rules of the surrounding protocol.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitches#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Base64 and base64url are different encodings
| Property | Standard Base64 | Base64url |
|---|---|---|
| Values 0–61 | A-Z, a-z, 0-9 |
Same |
| Value 62 | + |
- |
| Value 63 | / |
_ |
| Padding | = normally used when needed |
= may be retained or omitted according to the protocol |
| Typical use | Email bodies, MIME data, non-URL fields | URL components, tokens, identifiers when specified by the application |
RFC 4648 explicitly says base64url should not be regarded as the same encoding as ordinary Base64 or referred to simply as “base64.” A producer and consumer must agree on the alphabet. Replacing characters after encoding is not enough unless the decoder expects base64url.
Is ordinary Base64 safe in a URL?
It can be transported, but not safely by blindly concatenating it to a URL. For example, a standard Base64 value containing + in a query string may be interpreted by form-style parsers as a space. A slash can be interpreted as a path delimiter. An equals sign can be treated as a name/value separator depending on where it appears.
Query parameters
Use a URL or query-string encoder supplied by your language or framework. It will percent-encode reserved characters. Do not manually replace spaces, plus signs, or slashes with ad hoc substitutions. On the receiving side, parse the parameter with the matching URL decoder before Base64-decoding it.
Path segments
Prefer base64url for a value placed between slashes. Standard Base64’s / changes the apparent path structure even when the server eventually decodes it. If a protocol requires standard Base64, percent-encode the value and verify that the router does not decode it before route matching.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Fragments and other fields
Fragments are interpreted by clients and may never reach the server. A token intended for server authorization should not be placed there. For cookies, headers, signed links, and custom protocol fields, follow that field’s grammar rather than assuming that “URL-safe” is sufficient.
Should you remove the = padding?
Padding is independent of the alphabet. RFC 4648 uses = when the final 24-bit input group is incomplete and says encoders should include appropriate padding unless the referring specification explicitly permits omission.
Omitting padding can be practical when the data length is known or can be inferred. It also avoids percent-encoding = in some URI contexts. However, a decoder may require padding or may reject an input whose length is impossible. Never strip padding merely because a value is going into a URL.
Safe decision rule
- Read the target protocol’s definition of the field.
- Check whether it specifies standard Base64 or base64url.
- Check whether padding is required, optional, or forbidden.
- Use the library mode that matches those requirements.
- Test values whose encoded lengths leave zero, one, and two leftover input bytes.
How to encode and decode base64url
JavaScript in a browser
Browser btoa and atob use the standard alphabet. Convert the two characters explicitly and apply the padding rule required by your protocol.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
function toBase64Url(bytes) {
let binary = '';
for (const byte of bytes) binary += String.fromCharCode(byte);
return btoa(binary)
.replace(/+/g, '-')
.replace(///g, '_')
.replace(/=+$/, ''); // omit only if the protocol permits it
}
function fromBase64Url(value) {
const standard = value.replace(/-/g, '+').replace(/_/g, '/');
const padded = standard + '='.repeat((4 - standard.length % 4) % 4);
return Uint8Array.from(atob(padded), c => c.charCodeAt(0));
}For Unicode text, first encode it as UTF-8 bytes; do not pass arbitrary Unicode directly to btoa.
Python
import base64
raw = b"example"
encoded = base64.urlsafe_b64encode(raw).rstrip(b"=")
print(encoded.decode("ascii"))
# Add the required padding before decoding.
padded = encoded + b"=" * (-len(encoded) % 4)
decoded = base64.urlsafe_b64decode(padded)
print(decoded)Python’s urlsafe_b64encode uses the URL-safe alphabet but retains padding. The example removes it only for a protocol that permits unpadded input.
Node.js
const value = Buffer.from('example', 'utf8')
.toString('base64url');
const bytes = Buffer.from(value, 'base64url');
console.log(bytes.toString('utf8'));Recent Node.js versions provide the base64url encoding label. If your runtime does not, encode as standard Base64 and replace + and /, then apply the documented padding policy.
Validation and decoder behavior
Do not silently accept arbitrary characters. RFC 4648 says decoders should reject characters outside the selected alphabet unless the referring specification says otherwise. Whitespace handling also belongs to the protocol: MIME-style decoders may ignore line breaks, while token formats commonly require a continuous value with no whitespace.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Reject a standard-alphabet value when the field requires base64url.
- Reject impossible lengths (for example, a non-padded value whose length modulo four is one).
- Decide whether empty input is valid for your application.
- Decode only after URL parsing has completed, so percent-encoded bytes are restored correctly.
- Use constant-time comparison for decoded secrets or signatures where applicable.
Base64 is not encryption
Base64 changes representation; it does not provide confidentiality, integrity, authentication, or access control. RFC 4648 describes encoding as something that can visually hide recognizable information such as passwords but provides no computational confidentiality. Anyone who receives a Base64 value can decode it.
For confidential data, use encryption with proper key management. For tamper detection, use a cryptographic MAC or digital signature. For bearer credentials, use transport security and short lifetimes in addition to the protocol’s authentication design. Never place a password in Base64 and call it protected.
Common mistakes and fixes
| Symptom | Likely cause | Fix |
|---|---|---|
| Decoded text contains a space where a plus sign was expected | Form decoding converted + to a space |
Use base64url or percent-encode standard Base64 before placing it in the query. |
| Only part of a value reaches the server | / was interpreted as a path delimiter |
Use base64url in the path or encode the standard value for that segment. |
| Decoder reports invalid length | Padding was removed but the decoder requires it | Restore = padding or switch to a decoder that follows the field’s unpadded rule. |
| Signature verification fails after transport | Producer and consumer use different alphabets, padding, or byte encodings | Specify all three details and verify the exact bytes before signing and after decoding. |
| Token accepts unexpected characters | Decoder is permissive about non-alphabet input | Validate against the protocol’s alphabet and reject invalid characters. |
Practical checklist
- Identify the exact URL component or protocol field.
- Choose standard Base64 or base64url explicitly.
- Document whether
=padding is required. - Percent-encode when the component requires it; do not hand-edit characters.
- Use matching encode and decode modes on both ends.
- Test short inputs, binary bytes, Unicode text, and malformed values.
- Keep secrets encrypted or authenticated; Base64 alone is never a security boundary.
Or skip the browser setup
If your practical task is capturing a URL for documentation or testing rather than encoding a token, ScreenshotNeo provides a single website-screenshot API call. Its cleaner capture flow accepts consent banners and removes more than 60 known consent platforms, newsletter popups, and chat widgets before the shot; bot checks, blank pages, timeouts, failed loads, and cache hits are not billed, and response headers identify the page verdict and billing status. It also offers an MCP server with take_screenshot, get_page_info, and capture_pdf for AI clients.
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://stripe.com -o shot.webpSee the ScreenshotNeo documentation for options such as viewport and device presets, full-page and element capture, PDF output, custom headers and cookies, waits, blocking rules, caching, asynchronous jobs, bulk capture, and signed links. The free plan includes 1,000 shots per month with no card; paid plans start at $5 for 3,000 shots. Create a free ScreenshotNeo account.
Frequently Asked Questions
Can I decode base64url with a normal Base64 decoder?
Only after translating - to +, _ to /, and restoring any required padding. Use a decoder mode that explicitly supports base64url when available.
Best Value
- Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
- USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
Does URL encoding make Base64 encrypted?
No. Percent-encoding and Base64 are representations, not encryption. Anyone who obtains the value can reverse both transformations.
Which form should I document in an API contract?
Name the alphabet, padding policy, accepted whitespace, and the exact field or URL component. “Base64” alone is ambiguous when URL transport is involved.
The Bottom Line
Use base64url when a protocol calls for a URL-oriented value, preserve or omit padding only as that protocol specifies, and never mistake either Base64 variant for encryption.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
