Base64 vs Base64URL: What's the Difference?

The Two Alphabets

Both Base64 and Base64URL encode binary data as ASCII strings, but they differ in which characters they use and how they handle padding:

Why Does Base64URL Exist?

Standard Base64 uses + and /, which have special meaning in URLs and filenames. If a Base64 string appears in a URL parameter or path, these characters get misinterpreted or percent-encoded, breaking the data. Base64URL replaces them with - and _, which are URL-safe.

Converting Between Formats

// Base64 → Base64URL
function toBase64Url(base64) {
  return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
}

// Base64URL → Base64
function fromBase64Url(base64Url) {
  let base64 = base64Url.replace(/-/g, "+").replace(/_/g, "/");
  while (base64.length % 4) base64 += "=";
  return base64;
}

// Example
const standard = "dGVzdCt2YWx1ZS8=";  // "test+value/"
const urlSafe  = "dGVzdCt2YWx1ZS8";   // same data, no padding

toBase64Url(standard);  // → "dGVzdCt2YWx1ZS8"
fromBase64Url(urlSafe); // → "dGVzdCt2YWx1ZS8="

When to Use Which

• Base64: Data URIs in HTML/CSS, email attachments (MIME), embedding binary data in JSON where the string won't appear in a URL.
• Base64URL: JWT tokens, URL query parameters, filenames, OAuth state parameters — anywhere the encoded string passes through a URL or filesystem.