URL-Safe Base64 Guide: When Standard Base64 Breaks URLs
Standard Base64 uses + and / which break URLs. URL-safe Base64 substitutes - and _ instead. Learn when to use each, conversion steps, and library support.
Published:
Tags: encoding, url, base64
URL-Safe Base64 Guide: When Standard Base64 Breaks URLs Base64 is a common way to encode binary data as ASCII text. But the standard Base64 alphabet includes two characters — and — that have special meaning in URLs. Drop a standard Base64-encoded value into a URL and you get subtle, hard-to-debug corruption. This post explains why this happens, what URL-safe Base64 is, and where it is used in practice (including JWTs and PKCE). Why and Break URLs In a URL query string: means a space (in encoding) is a path separator If you take a standard Base64 value and put it in a query parameter without encoding it, the browser and server may interpret as spaces and as path separators: Even if you percent-encode it first with , you get — valid but verbose. Every becomes and every becomes . This works,…
All articles · theproductguy.in