🔗 Base64 URL Encoder – URL-Safe Encoding for Tokens & APIs
Base64 URL encoding is a text encoding format defined in RFC 4648 Section 5 that transforms arbitrary binary data into a compact, printable ASCII string safe for embedding directly in URLs, HTTP headers, JSON Web Tokens (JWTs), and cookie values — without requiring additional percent-encoding.
Standard Base64 vs Base64 URL
Standard Base64 uses the characters + and / which carry special meaning in URLs and must be escaped as %2B and %2F. Base64 URL elegantly solves this by substituting them:
| Character | Standard Base64 | Base64 URL |
|---|---|---|
| Index 62 | + | - |
| Index 63 | / | _ |
| Padding | = (required) | = (optional) |
How the Encoding Works
The encoder follows a deterministic four-step process for any input:
- Convert to bytes — The input string is encoded to a byte array using the selected character set (default UTF-8).
- Group into 3-byte blocks — Every three bytes form a 24-bit group; the last group is padded if necessary.
- Split into 6-bit values — Each 24-bit group yields four 6-bit indices (values 0–63).
- Map to URL-safe alphabet — Each index maps to a character from
A-Z,a-z,0-9,-,_.
// Core algorithm (JavaScript)
function base64UrlEncode(input, padding = false) {
const bytes = new TextEncoder().encode(input);
const base64 = btoa(String.fromCharCode(...bytes));
const urlSafe = base64.replace(/\+/g, '-').replace(/\//g, '_');
return padding ? urlSafe : urlSafe.replace(/=+$/, '');
}
// Example
base64UrlEncode("Hello, World!") → "SGVsbG8sIFdvcmxkIQ"Common Use Cases
🔐 JSON Web Tokens (JWT)
JWT header and payload segments are Base64 URL encoded (without padding). The signature is also Base64 URL encoded after HMAC or RSA signing.
🔑 OAuth 2.0 & PKCE
The OAuth 2.0 PKCE flow uses Base64 URL (no padding) to encode the code_verifier and code_challenge values during authorization.
📎 URL Query Parameters
Encode binary data or structured objects to embed safely in URL query strings, path segments, and link-sharing tokens without breaking URL parsers.
🍪 Cookie Values & HTTP Headers
HTTP cookies and custom headers have character restrictions. Base64 URL encoding ensures binary payloads survive transport without corruption.
Size Overhead
Base64 encoding expands data size by approximately 33%. The exact formula for output character count is:
output_chars (with padding) = ceil(inputBytes / 3) * 4
output_chars (without padding) = ceil(inputBytes * 4 / 3)
size_overhead (%) = ((outputChars - inputBytes) / inputBytes) * 100Padding Modes
Standard Base64 always pads the output to a multiple of 4 characters using = signs. Base64 URL encoding commonly omits padding because the string length is either known from context or can be inferred. Most JWT libraries and OAuth implementations use no padding by default.
Hex Input Mode
When working with raw binary data expressed as hexadecimal (e.g., hash digests, cryptographic keys, UUID bytes), the Hex input mode lets you paste a hex string and encode those exact bytes — bypassing character set interpretation entirely. For example, the hex bytes 48656c6c6f encode to SGVsbG8.
Converting Existing Standard Base64
If you already have a standard Base64 string with + and / characters, the tool's Base64 → Base64 URL conversion mode performs a simple character substitution without re-encoding, making migration of existing tokens straightforward.