The URL- and filename-safe Base64 alphabet replaces standard Base64's '+' and '/' (indices 62 and 63) with '-' and '_', so the output is safe to drop into URLs, query strings, and filenames without percent-encoding. The padding '=' is commonly omitted (e.g. in JWTs); RFC 4648 §3.2 permits this when the data length is known out of band.
aka: base64url · URL-safe base64 · filename-safe base64 · base64 (URL and filename safe alphabet) · JWT base64
RFC4648 · alphabet: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_
| input | output | note | |
|---|---|---|---|
| ÿï literal | → | _-8 ascii | Bytes 0xFF 0xEF: standard Base64 = '/+8=', URL-safe = '_-8'. Exercises BOTH alphabet substitutions ('/'->'_', '+'->'-') and the dropped '=' padding. (input read as latin1 so the two literal bytes 0xFF 0xEF are encoded directly.) |
| foob utf8 | → | Zm9vYg ascii | BASE64("foob") = 'Zm9vYg==' (standard); URL-safe no-padding form drops the '==' -> 'Zm9vYg'. |
| fo utf8 | → | Zm8 ascii | BASE64("fo") = 'Zm8=' (standard); URL-safe no-padding form drops the single '=' -> 'Zm8'. |
| foobar utf8 | → | Zm9vYmFy ascii | No '+', '/', or padding here, so the URL-safe output is identical to standard Base64 ('Zm9vYmFy'). |
| Zm9vYg ascii | → | foob utf8 | Round-trip: base64url-decode('Zm9vYg') = "foob" (no-padding input decodes fine; Node tolerates the missing '='). |
agent: curl -H 'accept: application/json' wire.phall.io/encoding/base64url
or /encoding/base64url.json