Encode or decode text to URL-safe Base64 format to safely transmit data.
Standard Base64 encoding is used to safely transport binary data across text-based protocols. However, it uses two characters that conflict with web URLs: + (plus) and / (slash).
If you put standard Base64 inside a URL query parameter without escaping it, web servers will misinterpret the + as a space, and the / as a directory separator, breaking the data.
To solve this, Base64URL was created. It is exactly the same algorithm as standard Base64, but with two simple character swaps:
+ character is replaced with - (minus)./ character is replaced with _ (underscore).Standard Base64 pads the end of the string with one or two = (equals) characters so the total length is a multiple of 4.
In Base64URL, padding is strictly omitted. This is because = is a reserved character in URLs (used for query parameters like ?key=value). Omitting it saves space and prevents parsing bugs in web frameworks.
JSON Web Tokens (JWTs) rely entirely on Base64URL encoding. A JWT consists of a Header, Payload, and Signature, each Base64URL encoded and separated by a period (.).
Because they use Base64URL, JWTs can be safely passed in HTTP Authorization headers or URL parameters without breaking the HTTP protocol.
Why does Base64URL omit the '=' padding character?