Standard Base64 vs Base64URL
| Base64 (standard) | Base64URL | |
|---|---|---|
| Character 62 | + | - |
| Character 63 | / | _ |
| Padding | = required | usually omitted |
| Safe in URLs | No (+ becomes a space) | Yes |
| Typical use | MIME, PEM, JSON blobs | JWT, OAuth, cookies, filenames |
The + character is decoded as a space in URL query strings and / is a
path separator, so standard Base64 breaks the moment it enters a URL. If your encoded value will
ever live in a query parameter, path segment, cookie, or filename, use Base64URL. If you are
inspecting a JWT, try the dedicated JWT Decoder, which splits and
decodes all three token segments for you.