Input

URL-Safe Base64 Output

Uses - and _ instead of + and / — safe for URLs & filenames

What is Base64 URL Encoding?

Standard Base64 uses + and / characters that carry special meanings in URLs. Base64url (RFC 4648 §5) is a URL-safe variant that replaces + with - and / with _, making it safe to use in URL parameters, query strings, file names, and HTTP headers without percent-encoding.

This encoding is the backbone of modern authentication. JSON Web Tokens (JWT) use Base64url to encode their header and payload. OAuth 2.0 (RFC 6749) uses it for PKCE code verifiers. Google's OAuth API and countless others rely on it daily.

All encoding and decoding runs client-side in your browser using the native btoa() and atob() APIs. Nothing is sent to our servers.

How to Use the Base64 URL Encoder

Follow these steps to encode or decode URL-safe Base64. Each step uses the actual buttons and panels on this page.

Choose Mode and Add Input

Select Encode to convert text to URL-safe Base64, or Decode for the reverse. Paste into the left Input panel, or click Sample to see example subscriber payload. Example encode input:

{"subscriberId":"SUB-12345","plan":"Premium","carrier":"Verizon"}

View Output

The right panel shows URL-safe Base64 (uses - and _ instead of + and /) or decoded text. Output updates instantly as you type.

Copy, Download, or Swap

Click Copy to grab the output, Download to save, or Swap to move output to input for round-trip testing. Use Clear to start fresh.

When You'd Actually Use This

JWT Token Inspection

JSON Web Tokens have three Base64url-encoded parts separated by dots. Decode any part here to inspect the header, payload, or signature bytes for debugging.

OAuth 2.0 PKCE

The PKCE extension (RFC 7636) for OAuth requires Base64url-encoding of SHA-256 code challenge hashes. Use this tool to encode and verify your code challenge before sending it to the authorization server.

URL Parameter Encoding

Encode binary data, IDs, or complex objects to include safely in URL query strings without %2B or %2F escaping. Pairs naturally with the <a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Basics_of_HTTP/Data_URLs" target="_blank" rel="noopener">Data URL</a> scheme and RESTful APIs.

File Names & Headers

Encode binary content for use in HTTP headers, filename attributes, or Content-Disposition headers where special characters would cause parsing issues.

Common Questions

What is the difference between Base64 and Base64url?

Standard Base64 (RFC 4648 §4) uses + and /. Base64url replaces those with - and _ to make the output safe for URLs, file names, and HTTP headers without percent-encoding.

Does Base64url use padding (= signs)?

Padding is optional in Base64url. JWTs and many OAuth implementations omit the trailing = signs since they can cause issues in URLs. This tool handles both padded and unpadded input in decode mode.

Can I use this for JWT decoding?

Yes — you can decode the header and payload sections of a JWT by pasting each dot-separated segment individually. Note: this tool does not verify JWT signatures; for full JWT verification use a dedicated library.

Is the output safe to use directly in a URL?

Yes. The encoded output only contains alphanumeric characters, hyphens (-), and underscores (_), which are all unreserved URL characters per RFC 3986.

Can I use Base64url in cookies?

Yes, Base64url is safe for use in cookies. However, be aware that some cookie attributes like SameSite may still apply regardless of encoding.

Is Base64 URL encoding the same as URL encoding?

No. URL encoding (percent-encoding) converts spaces to %20, +, etc. Base64url converts binary to text-safe characters. They serve different purposes but can work together.

Other Base64 Tools You Might Need

URL encoding is just one part of Base64 workflow. Here are related tools: