base64url

Base64URL, or base64url, is a variant of Base64 encoding designed for use in URLs and filenames. It uses the same underlying 64-character set as standard Base64 but replaces characters that have special meaning in URLs: '+' becomes '-' and '/' becomes '_'. Padding with '=' is optional in the URL-safe variant, and many implementations omit padding for compactness, especially in tokens and query strings.

Standardization and usage: Base64URL is defined in RFC 4648 as a URL- and filename-safe variant of Base64. It is widely employed in web technologies because the resulting strings can be embedded directly in URLs without additional percent-encoding. It is a core encoding form in JSON Web Tokens (JWT), OAuth 2.0, and OpenID Connect, among other protocols. In some contexts, such as JWT, padding is typically omitted; other contexts may preserve padding for compatibility with certain decoders.

Encoding and decoding details: The process mirrors standard Base64: binary data is split into 6-bit groups, each group maps to one of 64 characters in the alphabet. The URL-safe alphabet replaces two characters as described above. If the input length is not a multiple of 3, padding with '=' is used in standard Base64; in Base64URL, padding is often omitted, though some implementations can retain padding.

Security and interpretation: Base64URL is an encoding, not encryption. It provides no confidentiality or integrity by itself. When used in tokens or other security contexts, base64url data is typically combined with cryptographic signing or encryption to ensure integrity and authenticity.

Implementations: Most programming languages offer built-in support or libraries for base64url encoding and decoding, often named or accessible as URL-safe Base64 functions or options.