Base64 URL Encoder — URL-Safe base64url

It is a converter that produces base64url instead of standard Base64 — the alphabet in RFC 4648 §5, where value 62 is written `-` instead of `+` and value 63 is written `_` instead of `/`. Those two substitutions, plus dropping the `=` padding, leave only characters that are legal unescaped in a query string, a path segment and a filename. This tool takes plain text, standard Base64 or hex bytes as input and returns that form.

Exactly two characters, plus padding. Standard Base64 uses `+` and `/` for values 62 and 63; base64url uses `-` and `_` instead, and normally omits the trailing `=`. The 64-character payload alphabet is otherwise identical, so both encode the same bytes to the same length — you can convert between them with a search-and-replace, which is what this tool does after decoding your input to raw bytes.

No, and base64url is shorter. Percent-encoding turns each `+`, `/` and `=` into a three-character escape (`%2B`, `%2F`, `%3D`), costing two extra characters every time. base64url swaps those characters for URL-legal ones at no cost. The tool shows both lengths side by side, plus how many characters you save.

For URLs and JWTs, yes — RFC 7515 §2 requires JWT segments to have the padding removed, and `=` is a reserved character in URLs. Keep it only when the decoder on the receiving side is strict about canonical Base64. Padding carries no information: length modulo 4 always tells a decoder whether one or two characters were trimmed.

Divide the byte count by 3, round up, and multiply by 4 for the padded length; unpadded it is ceil(bytes × 4 ÷ 3). A 53-byte JSON payload, for example, becomes 72 padded characters or 71 unpadded. Base64 always costs about a third more than the raw bytes, and the tool reports the exact overhead percentage for your input.

Keep the whole URL under about 2,000 characters for reliable delivery — that is the practical floor set by old Internet Explorer's 2,083 limit and echoed by many proxies and analytics tools. Apache returns 414 for a request line over 8,190 characters by default, and a single cookie is only guaranteed to hold 4,096 bytes. Past those, move the payload into the request body or a header.

Not to plain text — it is an encoder. It can, however, normalise in the other direction: set "Interpret input as" to Standard Base64 and paste a base64url string, and it folds `-` back to `+`, `_` back to `/` and restores the `=` padding, so "Copy standard Base64" gives you the canonical form. For turning that back into readable text, use a Base64 decoder.

Leave "Interpret input as" on Plain text (UTF-8) and paste the whole address — https://example.com/path?a=1 and all. The URL is just text, so it is read as UTF-8 bytes and encoded like any other string, and because the output is base64url it can then be dropped into a query parameter, a path segment or a filename without any percent-escaping. That is the difference from URL-encoding: percent-encoding escapes the characters a URL cannot carry, while this replaces the whole string with an alphabet a URL can carry as-is.

It is completely free with no signup, and nothing is uploaded. The conversion runs entirely in your browser using TextEncoder and btoa — there is no server round-trip and no storage — so encoding an API key or token is safe. Input is capped at 2,000,000 characters, enough for a certificate or a long token.