Free Base64 URL Encoder Online
Encode text to URL-safe Base64url format instantly in your browser.
Input
Output (URL-safe, no padding)
Base64 URL Encoding Examples
URL-safe Base64 replaces + with - and / with _, and strips = padding. Example:
Text with URL-unsafe characters
Input:
Base64url output (no +, /, or = characters):
Click Sample above to load example data.
What Is Base64 URL Encoding?
You need to stick some binary data into a URL query parameter, but regular Base64 is full of +, /, and = characters that break URLs. That's exactly what Base64url solves. Defined in RFC 4648 Section 5, it swaps those problematic characters for URL-safe ones (- and _) and drops the padding. You'll find it everywhere in modern auth flows — JWTs, OAuth PKCE, WebAuthn. This tool encodes your text to Base64url right in the browser using the native btoa() function, so nothing ever leaves your machine.
Base64url is widely used in JSON Web Tokens (JWTs), OAuth 2.0 PKCE challenges, URL-safe identifiers, and anywhere Base64 data must appear in URLs without escaping. For standard Base64, use the Base64 Encoder. To decode Base64url, use the Base64 URL Decoder.
How to Use This Tool
Paste Your Text
Enter the text to encode in the left pane, or hit Sample to see what Base64url looks like for a typical string. The encoding is computed locally, so the input stays on your machine.
Read the URL-Safe Output
The right panel shows the Base64url result with no +, /, or = characters—safe to place directly in URLs, headers, or filenames without percent-encoding.
Copy or Download
Copy sends the encoded string to your clipboard and Download stores it as a .txt file. Going the other way, from Base64url back to text, is handled by the Base64 URL Decoder.
Standard Base64 vs Base64url
The only differences between standard Base64 and Base64url are three characters in the alphabet and the padding rule:
The output of this tool can be decoded back by re-adding the correct = padding and substituting -/_ back to +//. The Base64 URL Decoder handles this automatically.
Where Base64url Is Used
JWTs: JSON Web Tokens encode their header, payload, and signature as Base64url so they can be placed in HTTP headers and URL query parameters without escaping. OAuth 2.0 PKCE: The code verifier and challenge use Base64url; RFC 7636 shows the S256 challenge being built from a SHA-256 hash of the verifier. WebAuthn: Credential IDs and challenge values are Base64url encoded. URL-safe identifiers: Session tokens, API keys, and random nonces stored in cookies or URLs use Base64url to avoid encoding issues.
If you need to embed binary data in a URL query parameter and percent-encoding would make it too long, Base64url keeps it compact and URL-safe. For standard Base64 (with + and /), use the Base64 Encoder. For decoding standard Base64, use the Base64 Decoder.
Frequently Asked Questions
Is my data private?
Yes. The encoding is done with JavaScript in this browser tab and nothing gets uploaded. Keep DevTools open on the Network tab while you type and you will see no requests go out.
Why is there no = padding in the output?
RFC 4648 Section 5 defines Base64url without padding. The = character would need to be percent-encoded in URLs, defeating the purpose. Decoders that follow the spec re-add padding before decoding. The Base64 URL Decoder handles this automatically.
Can I use this for JWTs?
This tool encodes text to Base64url, which is the format used in the header and payload segments of a JWT. However, full JWT creation requires signing with a secret or private key. This tool is useful for encoding or inspecting JWT parts independently.
What's the difference from the Base64 Encoder?
The Base64 Encoder outputs standard Base64 using +, /, and =. This tool always outputs Base64url using -, _, and no padding—safe for use directly in URLs without any percent-encoding.
Does it support Unicode?
Yes. Text is first encoded to UTF-8 bytes using the browser's TextEncoder API, then converted to Base64url. Emoji, accented characters, and multi-byte scripts are all handled correctly.
Related Tools
For the formal specification, see RFC 4648 Section 5. The JWT introduction explains how Base64url is used in tokens.