Base64 URL Encoder
Encode data to URL-safe Base64 format with our free online encoder. URL-safe Base64 uses - and _ instead of + and /, making it safe for use in URLs, filenames, and other contexts where standard Base64 characters cause problems.
Why URL-Safe Base64?
Standard Base64 uses + and / characters which have special meanings in URLs and file paths:
- + becomes a space in URL query strings
- / is a path separator in URLs and filesystems
- = padding can cause issues in some parsers
Standard vs URL-Safe Comparison
| Feature | Standard Base64 | URL-Safe Base64 |
|---|---|---|
| Character 62 | + | - |
| Character 63 | / | _ |
| Padding | = (required) | Often omitted |
| URL safe | No | Yes |
| Filename safe | No | Yes |
| Cookie safe | No | Yes |
Encoding Examples
| Input | Standard | URL-Safe |
|---|---|---|
| Hello? | SGVsbG8/ | SGVsbG8_ |
| data+1 | ZGF0YSsx | ZGF0YSsx |
| test== | dGVzdD09 | dGVzdD09 |
Implementation
``javascript
// Encode to URL-safe Base64
function toBase64Url(text) {
const base64 = btoa(encodeURIComponent(text).replace(
/%([0-9A-F]{2})/g,
(_, p1) => String.fromCharCode(parseInt(p1, 16))
));
return base64
.replace(/\+/g, '-')
.replace(/\//g, '_')
.replace(/=+$/, '');
}
// Decode URL-safe Base64
function fromBase64Url(base64url) {
let base64 = base64url
.replace(/-/g, '+')
.replace(/_/g, '/');
// Add padding if needed
while (base64.length % 4) {
base64 += '=';
}
return decodeURIComponent(atob(base64).split('').map(
c => '%' + ('00' + c.charCodeAt(0).toString(16)).slice(-2)
).join(''));
}
// Node.js native support
const encoded = Buffer.from('Hello').toString('base64url');
const decoded = Buffer.from(encoded, 'base64url').toString();
`
Common Use Cases
JWT Tokens: Header and payload are Base64URL encoded- URL Parameters: Safely pass encoded data in query strings
- OAuth State: Encode state parameters for OAuth flows
- Filenames: Create safe filenames from arbitrary data
- Cookies: Store encoded data in cookies without escaping
- Short URLs: Encode IDs for URL shorteners
Tips for URL-Safe Base64
1. Check the checkbox in our encoder to enable URL-safe mode
2. Padding is optional - many implementations omit trailing = signs
3. Same data, different output - standard and URL-safe are interchangeable if you convert the characters
4. JWT uses URL-safe - all modern JWT libraries expect Base64URL encoding
Encoding Is Not Encryption
Base64 and percent-encoding both make data safe to *transport*. Neither makes it secret ā
both are trivially reversible by design, with no key involved. A Base64 string in a URL, a
cookie or a header is readable by anyone who sees it.
Purpose Use Safe transport of binary over text Base64 Safe transport of text in a URL Percent-encoding Confidentiality AES-GCM, TLS Integrity HMAC, a digital signature Password storage bcrypt, scrypt, Argon2
Size Costs
Base64 expands data by exactly 4/3 ā three bytes become four characters ā plus padding. A
100 KB image becomes about 133 KB as a data URI, and it cannot be cached separately from the
document that carries it. Inline small icons; link everything else.
Percent-encoding expands unpredictably: an ASCII character that needs escaping becomes three
characters, and a non-ASCII character becomes three per UTF-8 byte. Ć© is %C3%A9 ā six
characters for one letter.
UTF-8 Is the Only Sane Default
Every encoding decision on the modern web assumes UTF-8. Where it goes wrong:
btoathrows on non-Latin-1 input.Encode to UTF-8 bytes first:
btoa(String.fromCharCode(...new TextEncoder().encode(text))).
atobreturns Latin-1.Decode back withnew TextDecoder().decode(bytes).- A BOM breaks parsers. Excel writes one at the start of CSV exports; strip it before
parsing.
Length is ambiguous."šØāš©āš§".lengthis 8 in JavaScript, 1 to a reader. Use
Intl.Segmenter` when the count is shown to a person.