Developer
Encoders, converters & dev utilities
URL-Safe Base64 (base64url) Converter
Convert to and from URL-safe Base64 — the base64url variant defined in RFC 4648 §5. Standard Base64 uses + and / and pads with =, but those characters have special meaning in URLs and file names, so the URL-safe alphabet swaps + for - and / for _ and usually drops the = padding. This is exactly the encoding used for the header and payload of a JWT and for opaque values passed in query strings. The bytes are identical; only two characters and the padding differ. Worked example: three 0xFF bytes encode to //// in standard Base64 and to ____ in URL-safe; the bytes FF FF FE give ///+ standard and ___- URL-safe. Runs 100% in your browser. Free, no login.
URL-safe (base64url, RFC 4648 §5): + becomes -, / becomes _, and = padding is typically omitted
- Byte-exact worked example: bytes FF FF FF → "////" standard → "____" URL-safe
- Byte-exact worked example: bytes FF FF FE → "///+" standard → "___-" URL-safe (only +/ and / change)
- Same bytes, different alphabet — JWT header.payload and URL query values use base64url
- 100% client-side; Base64/base64url is encoding, not encryption — it hides nothing
Frequently asked questions
What is URL-safe Base64 (base64url)?
It is the variant of Base64 from RFC 4648 §5 designed to be safe inside URLs and file names. The only differences from standard Base64 are the two characters that would otherwise cause trouble in a URL: + is replaced by - and / is replaced by _. The = padding is also commonly omitted. The underlying bytes are exactly the same — for example the bytes FF FF FF are //// in standard Base64 and ____ in URL-safe.
Why does a JWT use URL-safe Base64?
A JWT is passed around in URLs, HTTP headers, and cookies, so its three parts (header, payload, signature) are encoded with base64url and joined by dots. If they used standard Base64, the + and / characters and the = padding could break URL parsing or need percent-encoding. Using the -/_ alphabet with no padding keeps the token compact and safe to place anywhere a URL component is expected.
How do I convert standard Base64 to URL-safe Base64?
Replace every + with -, every / with _, and remove the trailing = padding (a base64url decoder re-adds it as needed). To go the other way, swap - back to + and _ back to /, then restore padding so the length is a multiple of 4. This tool does the substitution for you and can encode or decode in either alphabet, entirely in your browser.