Short answer
Base64url uses - and _ in place of + and /, and often omits = padding, so the output is safe in URLs and filenames. The bytes FB FF FE are +//+ in standard Base64 and -__- in Base64url. JWTs use Base64url without padding.
1. Side by side
| Standard (RFC 4648 section 4) | URL-safe (section 5) | |
|---|---|---|
| Index 62 | + | - (hyphen) |
| Index 63 | / | _ (underscore) |
| Padding | = | = or omitted |
| Typical use | Email, data URIs | URLs, filenames, JWTs |
2. Example
- Bytes FB FF FE: standard +//+, URL-safe -__-.
- The grinning-face emoji: standard 8J+YgA==, URL-safe 8J-YgA==.
- Most plain text, such as Hello, encodes the same in both.
3. Why JWTs use it
A JSON Web Token carries its header and payload as Base64url without padding so the token is safe in URLs and headers. The header {"alg":"HS256","typ":"JWT"} becomes eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.
4. Converting
- Standard to URL-safe: replace + with -, / with _, and strip =.
- URL-safe to standard: reverse the swaps and add = until the length is a multiple of 4.
The Base64 tool has a URL-safe option. For percent-encoding see URL Encode Decode.
5. Frequently asked questions
What is Base64url?expand_more
A variant of Base64 that uses - and _ instead of + and /, so it is safe in URLs and filenames.
Does Base64url use padding?expand_more
It may include = but many systems, including JWTs, leave it out.
Why do JWTs use Base64url?expand_more
So tokens can sit in URLs and HTTP headers without characters that need escaping.
Can I decode a JWT with a normal Base64 decoder?expand_more
Yes after swapping - and _ back and adding padding, or by using the tool's URL-safe option.