Base64 to Base64URL Converter (URL-Safe)

How to convert Base64 to Base64URL

1. Paste the Base64 into Input · Base64. Line breaks from wrapped Base64 and a data:...;base64, prefix are removed automatically.
2. The URL-safe string appears in Output · Base64URL.
3. Tick Padding (=) under the output if the receiver wants the trailing = kept.
4. Copy output. The Base64URL → Base64 toggle, or Base64URL to Base64, converts back.

The input is decoded to bytes and re-encoded, so a string that is not valid Base64 gets an error instead of a half-converted result.

Examples

The last row is common. Short JSON and ASCII text often encode without + or /, and when the length is a multiple of 3 bytes there is no padding either, so the two forms are identical. That is also why a forgotten conversion can go unnoticed in testing until some value happens to produce a + or /.

Standard Base64 characters that break URLs

Three characters of standard Base64 have a special meaning in URLs:

• + means a space in query strings, so ?t=a+b arrives as a b in many frameworks.
• / separates path segments, so Base64 in a path can be split or routed wrongly.
• = separates a query parameter’s name from its value and has to be written %3D to be safe.

RFC 4648 section 5 defines Base64URL for this case, with - and _ in place of + and / and padding that may be left out. Such values need no escaping in paths, query strings, cookies or file names. The Base64 vs Base64URL article covers the details.

Where Base64URL is required

• JWT and JWS. All three segments of a JSON Web Token use Base64URL without padding. The JWT decoder reads them, and Base64 in JWT explains the format.
• OAuth PKCE. Hash tools often print the SHA-256 digest of the verifier as standard Base64, while code_challenge must be that digest in Base64URL without padding. This conversion is the last step.
• WebAuthn and JWK. Credential IDs, challenges and the key parameters in a JSON Web Key are Base64URL.
• Signed URLs and tokens in links, such as password reset or download links, where the value sits in a path or query string.

To encode text straight to Base64URL without the intermediate standard form, use the Base64URL encoder.

Base64 to Base64URL in code

import base64
base64.urlsafe_b64encode(b"<<???>>").rstrip(b"=").decode()   # 'PDw_Pz8-Pg'

Buffer.from("PDw/Pz8+Pg==", "base64").toString("base64url");   // 'PDw_Pz8-Pg'
"PDw/Pz8+Pg==".replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");   // same, without Buffer

Python’s urlsafe_b64encode keeps the padding, hence the rstrip. Node’s "base64url" encoding drops it. More in the Python and Node.js guides.

FAQ