The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →A Base64 URL usually means base64url, the URL- and filename-safe variant of Base64 defined in RFC 4648. It represents bytes as text, changes + to - and / to _, and may omit trailing = padding when the protocol can infer it. Base64url is encoding, not encryption: anyone who gets the string can decode it.
What “Base64 URL” means
“Base64 URL” is informal wording. In standards and APIs, the precise name is base64url, also called the Base 64 URL- and Filename-safe Alphabet. Section 5 of RFC 4648 says the encoding “may be referred to as ‘base64url’” and warns that it should not be regarded as the same encoding as ordinary “base64.”
Both formats convert arbitrary bytes into printable ASCII. The difference is the alphabet used for two values and the way padding is handled:
| Property | Standard Base64 | Base64url |
|---|---|---|
| Values 0–61 | A–Z, a–z, 0–9 |
Same |
| Value 62 | + |
- |
| Value 63 | / |
_ |
| Padding | = is normally included |
Often omitted when the protocol specifies unpadded output |
| Typical uses | Email, binary-to-text fields, many data formats | URL path or query values, filenames, compact identifiers and tokens |
The substitution avoids characters that have special meanings in URL syntax or are awkward in filenames. It does not change the underlying bytes or make them secret.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
#1 Best Overall
How Base64url encodes data
Twenty-four input bits become four characters
Base64 processes input in groups of three bytes, or 24 bits. It splits those 24 bits into four six-bit numbers. Each six-bit number selects one character from the 64-character alphabet. That is why Base64 carries 6 bits per printable character, as described by the Internet Engineering Task Force (IETF) in RFC 4648 (2006).
For example, the ASCII bytes for Man become the standard Base64 text TWFu. None of those characters require substitution, so its base64url spelling is also TWFu. Data containing the alphabet positions 62 or 63 demonstrates the visible difference: standard output can contain + or /, while base64url uses - or _.
Why padding exists
Three input bytes produce exactly four output characters. If the final group contains only one or two bytes, the encoder normally adds = characters so the output length remains a multiple of four:
| Input bytes in final group | Standard padded result | Unpadded base64url length adjustment |
|---|---|---|
| 3 | No padding | No adjustment |
| 2 | One = |
Remove one = |
| 1 | Two = characters |
Remove both = characters |
RFC 4648 says implementations normally include appropriate padding unless the referring specification says otherwise. A base64url profile that omits padding relies on the encoded length to recover the missing characters. Do not remove padding merely because a string happens to be used in a URL; follow the protocol’s rule.
Is base64url the same as Base64?
No. They encode the same way but define different alphabets and potentially different padding. A decoder written for one profile may reject, mis-handle or incorrectly normalize output from the other. Always check the field’s specification rather than deciding from the appearance of one sample.
Rank #2
- HTML CSS Design and Build Web Sites
- Comes with secure packaging
- It can be a gift option
When to choose base64url
- Putting binary data in a URL path or query parameter.
- Creating an identifier intended to be safe in common filenames.
- Interoperating with a protocol that explicitly names “base64url” or a URL-safe Base64 alphabet.
- Producing an unpadded token when the protocol explicitly requires unpadded output.
When standard Base64 is appropriate
- Fields whose schema explicitly says Base64 and accepts
+,/and padding. - Binary-to-text content where URL parsing is not involved.
- A
data:URL payload. The Base64 portion of a data URL can use standard Base64 because it is not being placed in a path segment or query parameter.
Do not “URL-encode” a standard Base64 string as a substitute unless the receiving protocol specifically says to percent-encode it. Percent encoding and base64url are different layers and may produce different expected values.
Why tokens contain hyphens and underscores
Hyphens and underscores are the two deliberate substitutions that identify the URL-safe alphabet. They do not indicate corruption, a special encryption mode or a different underlying byte sequence. A token can also contain ordinary letters, digits and, depending on the profile, trailing = characters.
Base64 is case-sensitive. Changing an uppercase character to lowercase changes its six-bit value and normally changes the decoded bytes. Treat the complete string as an opaque value unless you are using a documented decoder.
Padding: should you remove the equals signs?
Only when the protocol specifies unpadded base64url or otherwise provides the original length. Padding is not extra data; it signals how many bytes were present in the final partial group. A decoder can infer it from an unpadded length whose remainder modulo four is 0, 2 or 3:
- Remainder 0: add no padding.
- Remainder 2: add two
=characters. - Remainder 3: add one
=character. - Remainder 1: invalid encoded length; no legal amount of padding can repair it.
Some libraries expose separate standard and URL-safe functions; others accept a flag or an encoding name. Use the URL-safe function and let it apply the profile’s padding behavior. For strict validation, reject characters outside the permitted alphabet instead of silently discarding them.
Rank #3
Encode and decode base64url in code
Python (UTF-8 text and arbitrary bytes)
Python’s urlsafe_b64encode performs the two alphabet substitutions. The example removes padding only for an explicitly unpadded profile and validates input before decoding.
import base64
import re
def encode_base64url(value: str) -> str:
raw = value.encode("utf-8")
return base64.urlsafe_b64encode(raw).rstrip(b"=").decode("ascii")
def decode_base64url(token: str) -> bytes:
# This accepts the unpadded URL-safe profile only.
if not re.fullmatch(r"[A-Za-z0-9_-]*", token):
raise ValueError("invalid base64url character")
if len(token) % 4 == 1:
raise ValueError("invalid base64url length")
padded = token + "=" * (-len(token) % 4)
return base64.urlsafe_b64decode(padded)
encoded = encode_base64url("café / résumé")
print(encoded)
print(decode_base64url(encoded).decode("utf-8"))Encode bytes directly when the input is a file, hash or cryptographic value; do not first interpret arbitrary bytes as text. For a profile that requires padding, omit the .rstrip(b"=") call and accept or emit the padded result.
Free tools Windows power users keep installed
One-click scans. No signup required.
Node.js
This version works with the standard Buffer API. It uses UTF-8 for the text example and performs strict alphabet and length checks before decoding.
function encodeBase64Url(text) {
return Buffer.from(text, "utf8")
.toString("base64")
.replace(/+/g, "-")
.replace(///g, "_")
.replace(/=+$/, "");
}
function decodeBase64Url(token) {
if (!/^[A-Za-z0-9_-]*$/.test(token)) {
throw new Error("invalid base64url character");
}
if (token.length % 4 === 1) {
throw new Error("invalid base64url length");
}
const padded = token + "=".repeat((4 - (token.length % 4)) % 4);
const standard = padded.replace(/-/g, "+").replace(/_/g, "/");
return Buffer.from(standard, "base64");
}
const token = encodeBase64Url("café / résumé");
console.log(token);
console.log(decodeBase64Url(token).toString("utf8"));Node versions that provide a base64url buffer encoding can use it directly, but the explicit substitutions make the required transformation visible and portable across versions.
Browser note
btoa and atob operate on byte-like strings, not arbitrary Unicode text. Convert text with TextEncoder and TextDecoder, or use a library that documents its UTF-8 behavior. Passing a non-ASCII JavaScript string directly to btoa can throw an exception or produce the wrong bytes.
Rank #4
- Brand: Wiley
- Set of 2 Volumes
- A handy two-book set that uniquely combines related technologies Highly visual format and accessible language makes these books highly effective learning tools Perfect for beginning web designers and front-end developers
Validation and decoding failures
Common symptoms and fixes
| Symptom | Likely cause | Fix |
|---|---|---|
| “Invalid character” or a rejected token | The decoder expects standard Base64, but the value contains - or _, or the reverse. |
Select the URL-safe decoder or map the two alphabets only when the protocol permits it. |
| Length modulo four equals one | The value is truncated or contains a missing character; padding cannot repair it. | Obtain the complete token and verify transport did not strip a character. |
Unexpected output after removing = |
The receiving side requires padded Base64. | Preserve padding or add it back according to the documented profile. |
| Decoded text contains replacement characters | The bytes are not UTF-8 text, or the original used another character encoding. | Treat the result as bytes and use the encoding specified by the producer. |
| Token changes after putting it in a query string | URL parsing, form encoding or a proxy altered reserved characters. | Use base64url, transmit it with the protocol’s required escaping, and compare the received value before decoding. |
| Decoder accepts junk around a token | The library silently ignores non-alphabet characters. | Apply an explicit allow-list check before decoding when validation matters. |
Do not decode twice
Base64url output is text, so it is easy to accidentally encode it again or decode an already decoded value. Keep track of the data type at each boundary: original bytes, encoded ASCII, URL-escaped text or decoded bytes. Log lengths and validation results rather than secrets.
Is Base64 URL encryption?
No. Base64url provides no computational confidentiality. Decoding is reversible and requires no key. Anyone who obtains the string can recover its bytes, and a person can often read the result immediately if it is UTF-8 or JSON.
Use authenticated encryption, TLS for transport, access controls and a key-management design when data must remain confidential or tamper-evident. Encoding can make binary data fit a text field; it cannot replace those security controls. Do not put passwords, private keys or other secrets into a base64url value assuming the alphabet hides them.
Size, performance and interoperability
Base64 expands data because every four output characters represent three input bytes. For large inputs, the padded representation is approximately one-third larger than the original, before URL escaping or other framing. That overhead is usually acceptable for identifiers and small payloads, but it can matter in query-string limits, headers, cookies and mobile messages.
- Keep the original bytes when a binary channel is available.
- Encode once at the boundary where a text representation is required.
- Do not compress tiny values solely to offset Base64 overhead; compression can make small data larger.
- Specify alphabet, padding, character encoding and maximum length in an API contract.
- Test empty input, one- and two-byte inputs, values containing both substituted characters, non-ASCII text and malformed lengths.
Two strings can decode to the same bytes if one is padded and the other is an accepted unpadded spelling. If your application compares encoded values, normalize them according to the protocol first or compare the decoded bytes.
Recommended Free Tools
Base64url in data URLs, paths and query parameters
Data URLs
A data URL has a media type and a payload, such as data:image/png;base64,.... Standard Base64 is commonly used in that payload. Do not automatically replace its characters with the URL-safe alphabet unless the consumer explicitly supports base64url.
Path segments and query values
Use the alphabet required by the receiving service. Base64url avoids the most troublesome Base64 characters, but it does not remove every URL concern: percent encoding, length limits, normalization and application-level escaping still apply. Keep the encoded value in one parameter or segment and do not allow whitespace or line breaks.
Filenames
Base64url is generally a better fit than standard Base64 for generated filenames because hyphens and underscores are ordinary filename characters on common systems. Still impose a length limit and avoid using an untrusted decoded value as a path without sanitizing it.
A separate tool choice when your workflow also needs screenshots
If your application turns captured web pages into image or PDF assets, ScreenshotNeo is a website screenshot API and MCP server from Yorker Media. It accepts one GET request and returns PNG, JPEG, WebP or PDF output. Before capture it can accept consent banners and remove more than 60 known consent platforms, newsletter popups and chat widgets; each cleanup step can be disabled. Bot checks, CAPTCHAs, blank pages, timeouts, failed loads and cache hits are not billed, and response headers identify the page verdict and billing result.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Or skip the browser setup:
Use the API call below when you need a screenshot rather than managing a browser yourself. Full request options and parameter names are listed in the ScreenshotNeo documentation.
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://stripe.com -o shot.webpimport requests
r = requests.get("https://api.screenshotneo.com/v1/shot", params={"access_key": "YOUR_API_KEY", "url": "https://stripe.com"}, timeout=90)
open("shot.webp", "wb").write(r.content)const q = new URLSearchParams({ access_key: 'YOUR_API_KEY', url: 'https://stripe.com' }); const res = await fetch(`https://api.screenshotneo.com/v1/shot?${q}`);Cookie banners, popups and chat widgets are removed before the shot; bot checks, blank pages and failed loads are never billed; and its MCP server lets AI agents take screenshots. The Free plan includes 1,000 screenshots a month with no card, and paid plans start at $5 for 3,000. Create a free ScreenshotNeo account.
Frequently asked questions
Is base64url case-sensitive?
Yes. Uppercase and lowercase letters map to different six-bit values. Preserve the exact characters produced by the encoder.
Can an empty string be valid base64url?
Yes. Empty input encodes to an empty string. Whether an empty value is allowed is a rule of the surrounding field, not of the encoding itself.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWhy do two libraries return different-looking results for the same bytes?
One may emit standard Base64 with +, / and =, while the other emits unpadded base64url. Confirm the profile before treating the outputs as unequal.
Can I safely display decoded bytes as text?
Only after confirming the expected character encoding and content type. Arbitrary decoded bytes may be an image, compressed stream or encrypted value rather than human-readable text.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
