The encoding algorithm is identical; only the alphabet differs. Standard Base64 uses + and /, while Base64URL swaps them for - and _ and strips the trailing = padding. The two outputs differ in length by a few characters, and a standard decoder cannot read a Base64URL string directly.
| Base64 Encode / Decode | Base64URL Encode | |
|---|---|---|
| Characters 62 and 63 | + and / | - and _ |
| Trailing = padding | Padded to a multiple of four | Never present |
| Inside a URL | + becomes a space, / becomes a path separator | Safe as-is |
| Typical consumers | Binary fields in JSON, email encoding | JWT header and payload, cookies |
Base64 represents binary data with 64 printable characters, so binary can travel through text-only protocols. Encode: encodes any data into strings of the 64 characters A-Z, a-z, 0-9, + and / Decode: restores the original data from a Base64 string URL-safe mode: replaces + with -, / with _, and drops the = padding
Base64URL is the URL-safe variant of Base64, used by JWTs and other values that travel in a URL. Replace + with - Replace / with _ Drop the trailing = padding
Decide by destination: URL, cookie or JWT takes the URL variant; everything else takes standard Base64. Match the decoder too — a standard decoder rejects base64url as invalid characters.
