A Deep Dive into Base64 vs Base64URL
The Problem with Standard Base64
Base64 is a brilliant, decades-old encoding scheme designed to safely transport raw binary data across communication channels that were only built to handle reliable ASCII text. It takes any binary input and translates it into an alphabet of 64 safe characters: the uppercase letters A-Z, the lowercase letters a-z, the numbers 0-9, the plus sign +, and the forward slash /. It also pads the end of the string with equals signs = to ensure the length is a multiple of 4.
However, when the modern web emerged, a massive problem became apparent. If you try to pass a standard Base64 string through a URL, a query parameter, or certain HTTP headers, the web infrastructure breaks it.
- The
+character is historically interpreted by web servers as a "space" in URL query parameters. - The
/character is interpreted as a directory or path separator. - The
=character is universally used as a key-value separator (e.g.,?token=value).
If you put a standard Base64 string in a URL, the receiving server will parse it incorrectly, corrupting your data entirely.
The Base64URL Solution
To solve this critical flaw, the IETF published RFC 4648, which introduced the Base64URL encoding scheme. It is nearly identical to standard Base64, but it makes three crucial, URL-safe modifications to the alphabet:
- Replaces the
+character with a-(minus sign). - Replaces the
/character with an_(underscore). - Completely omits the
=padding at the end of the string.
JWTs and Base64URL
Because JSON Web Tokens (JWTs) are explicitly designed to be passed in HTTP Authorization headers, deep-link URLs, and query strings, the JWT specification strictly mandates the use of Base64URL encoding for both the header and the payload.
This is why, if you attempt to decode a JWT using a generic, legacy Base64 decoding tool, you will almost always encounter parsing exceptions or garbled text. You must use a tool specifically designed to understand and safely revert the URL-safe modifications of the Base64URL alphabet.