URL-safe Base64

Why standard Base64 breaks URLs and how the URL-safe alphabet fixes it.

Standard Base64 uses + and /, which change meaning inside a URL or filename. URL-safe Base64 substitutes - and _ and can omit padding, so the encoded value survives transport unchanged.

01Alphabet differences

  • Standard alphabet: A-Z, a-z, 0-9, +, /.
  • URL-safe alphabet: A-Z, a-z, 0-9, -, _.
  • Padding = may be dropped when the length is known from context.

02Limitations

URL-safe Base64 changes the alphabet only. It does not reduce the size overhead and provides no confidentiality.

Sources

  1. RFC 4648: The Base16, Base32, and Base64 Data Encodings — IETF (accessed 2026-09-01)