Question 1

What is Base64URL encoding?

Accepted Answer

Base64URL is a URL-safe variant of Base64 that replaces + with -, / with _, and omits padding = characters. It is used in JWTs, OAuth tokens, PKCE code challenges, and anywhere Base64 data appears in URLs.

Question 2

Why can't standard Base64 be used directly in URLs?

Accepted Answer

Standard Base64 uses + and / which need percent-encoding in URLs. Base64URL replaces + → - and / → _, and removes padding =. The data is otherwise identical.

Question 3

Where is Base64URL used?

Accepted Answer

JWTs use Base64URL for header and payload encoding. OAuth PKCE uses it for code_challenge. URL shorteners use it for IDs. WebAuthn and FIDO2 use it for credential data. Any system passing binary data in URLs benefits from Base64URL.

Question 4

How do I decode a JWT payload?

Accepted Answer

A JWT is three Base64URL-encoded parts separated by dots. The second part is the payload. Take the string between the first and second dot, decode it with Base64URL, then parse as JSON. This tool does the Base64URL decoding step.

Question 5

Is Base64URL encryption?

Accepted Answer

No. Like standard Base64, it is encoding only — completely reversible without a key. For secure data, use authenticated encryption (AES-GCM).

Question 6

What is the difference between Base64 and Base64URL?

Accepted Answer

Standard Base64 uses + and / as special characters and = for padding — these must be percent-encoded in URLs. Base64URL replaces + with -, / with _, and omits padding, making the output safe for use in URLs and filenames without escaping. JWTs use Base64URL encoding for their header and payload. Use DevDecode's Base64 Encoder for standard Base64.

Question 7

When should I use Base64URL encoding?

Accepted Answer

Use Base64URL when the encoded string will appear in: URL path segments, query parameters, HTTP headers, cookies, filenames, or JSON payloads that will be used in URLs. JWTs always use Base64URL. Standard Base64 is fine for email attachments and data URIs. Both are equally decodable — the difference is only in the character set used.

Base64URL Encoder/Decoder — Free Online Base64URL Encode Decode

Frequently Asked Questions

Base64URL: The JWT and OAuth Encoding Format

Related Tools

Base64

JWT Decoder

PKCE Generator

URL Encoder