wire / encoding / base64url

Base64url — URL- and filename-safe Base64 (RFC 4648 §5)

The URL- and filename-safe Base64 alphabet replaces standard Base64's '+' and '/' (indices 62 and 63) with '-' and '_', so the output is safe to drop into URLs, query strings, and filenames without percent-encoding. The padding '=' is commonly omitted (e.g. in JWTs); RFC 4648 §3.2 permits this when the data length is known out of band.

encoding kind encoding status standard verification verified tier A encoding@1

aka: base64url · URL-safe base64 · filename-safe base64 · base64 (URL and filename safe alphabet) · JWT base64

test vectors

RFC4648 · alphabet: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_

inputoutputnote
ÿï literal _-8 ascii Bytes 0xFF 0xEF: standard Base64 = '/+8=', URL-safe = '_-8'. Exercises BOTH alphabet substitutions ('/'->'_', '+'->'-') and the dropped '=' padding. (input read as latin1 so the two literal bytes 0xFF 0xEF are encoded directly.)
foob utf8 Zm9vYg ascii BASE64("foob") = 'Zm9vYg==' (standard); URL-safe no-padding form drops the '==' -> 'Zm9vYg'.
fo utf8 Zm8 ascii BASE64("fo") = 'Zm8=' (standard); URL-safe no-padding form drops the single '=' -> 'Zm8'.
foobar utf8 Zm9vYmFy ascii No '+', '/', or padding here, so the URL-safe output is identical to standard Base64 ('Zm9vYmFy').
Zm9vYg ascii foob utf8 Round-trip: base64url-decode('Zm9vYg') = "foob" (no-padding input decodes fine; Node tolerates the missing '=').

provenance

see also

agent: curl -H 'accept: application/json' wire.phall.io/encoding/base64url or /encoding/base64url.json