Base64url encoder and decoder
“hello world” becomes aGVsbG8gd29ybGQ in Base64url, the URL-safe Base64 of RFC 4648 section 5 that uses minus and underscore instead of plus and slash and drops the equals padding, so tokens travel in links untouched. Free in your browser.
- Free
- Runs in your browser
- No sign-up
- Your data stays on your device
Run — free
Worked example
- Text
- hello world
- Calculation mode
- Encode
- Result
- aGVsbG8gd29ybGQ
- Encoding
- base64url
- Input bytes
- 11
- Output bytes
- 15
This Base64url encoder converts plain text into URL-safe Base64 and decodes Base64url strings back to UTF-8 text using the RFC 4648 section 5 alphabet. The engine is fully deterministic: the same input and mode always produce the same result, with no network calls, no random salts, and no date-dependent shortcuts. Common checks include encoding hello world to aGVsbG8gd29ybGQ and decoding that string back to the original phrase.
What Base64url is and what this tool returns
Base64url is the URL-safe sibling of classic Base64 defined in RFC 4648 section 5. Both schemes map every three input bytes to four six-bit symbols drawn from a sixty-four character alphabet, but Base64url replaces the plus and slash symbols with minus and underscore and omits the equals padding that standard Base64 appends when the byte length is not a multiple of three. That small alphabet change is why identity tokens, OAuth state parameters, signed cookie fragments, and content hashes travel cleanly inside URLs and HTML attributes without percent-encoding.
This page always uses that unpadded URL-safe alphabet: encode mode UTF-8 encodes your text, packs the bytes, and returns only A through Z, a through z, zero through nine, minus, and underscore; decode mode reverses the process and rejects standard Base64 characters, whitespace, and incomplete final quanta.
Where Base64url shows up in links and tokens
Developers meet Base64url when they inspect JWT segments, craft OAuth state and nonce values, embed small binary-safe claims in query parameters, or store opaque identifiers in text-only configuration files. Frontend teams decode URL-safe tokens during integration debugging without pasting data into ad-hoc scripts that accidentally reintroduce plus and slash. Backend services encode configuration snippets or short binary digests before putting them in redirect URLs where standard Base64 would break.
Quality engineers generate deterministic encode and decode pairs for contract tests so a middleware that claims Base64url support cannot silently switch alphabets. Educators use the same tool when teaching the difference between MIME Base64 and the URL-safe variant that modern auth stacks standardize on.
What you can do with it
JWT and OAuth token practice
Encode or decode URL-safe segments used in JWTs, OAuth state, and nonce values without standard Base64 padding or +/ characters.
FAQ
What does the Base64url encoder cost?
It is free in your browser on this page.
How is Base64url different from standard Base64?
Base64url uses - and _ instead of + and /, and this tool never emits or accepts = padding. Standard Base64 with + / = is rejected on decode.
What happens if I paste standard Base64 with + or =?
Replace + with -, / with _, strip padding, or use a standard Base64 tool instead.
Is the result deterministic?
Yes. The same text and mode always produce the same result with no network, randomness, or date-dependent behavior.
Why does my Base64url result have no equals signs at the end?
Because Base64url leaves out the padding that standard Base64 adds. “hello world” becomes aGVsbG8gd29ybGQ with nothing after it. When decoding, a length that leaves exactly one character over in a group of four is rejected, since it cannot hold whole bytes.
Related tools
For developers — API access
Everything on this page is available programmatically. This section is for teams who want to wire it into their own systems; everyone else can just use the tool above.
API endpoint
Prefer to automate it? One authenticated POST creates the task; the result comes back by webhook or a signed link. The same capability also runs here on the web, by email and from Telegram — and soon from our app too.
Call it from your stack
curl -X POST https://api.kit.forhosting.com/enc/base64url \
-H "Authorization: Bearer $KIT_KEY" \
-H "Content-Type: application/json" \
-d '{"text":"hello world"}'const res = await fetch("https://api.kit.forhosting.com/enc/base64url", {
method: "POST",
headers: {
"Authorization": `Bearer ${process.env.KIT_KEY}`,
"Content-Type": "application/json"
},
body: JSON.stringify({
"text": "hello world"
})
});
const { task_id } = await res.json();import os, requests
res = requests.post(
"https://api.kit.forhosting.com/enc/base64url",
headers={"Authorization": f"Bearer {os.environ['KIT_KEY']}"},
json={
"text": "hello world"
},
)
task_id = res.json()["task_id"]<?php
$res = file_get_contents("https://api.kit.forhosting.com/enc/base64url", false, stream_context_create([
"http" => [
"method" => "POST",
"header" => "Authorization: Bearer " . getenv("KIT_KEY") . "\r\nContent-Type: application/json",
"content" => '{"text":"hello world"}',
],
]));
$task = json_decode($res, true);body := bytes.NewBufferString(`{"text":"hello world"}`)
req, _ := http.NewRequest("POST", "https://api.kit.forhosting.com/enc/base64url", body)
req.Header.Set("Authorization", "Bearer "+os.Getenv("KIT_KEY"))
req.Header.Set("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)Example request
{
"text": "hello world"
}Example response
{
"task_id": "tsk_a1b2c3d4e5f6a1b2c3d4e5f6",
"type": "enc.base64url",
"status": "queued",
"_links": {
"result": "/tasks/tsk_…/result"
}
}The API is asynchronous: the call returns a task_id immediately and the result arrives by webhook. Polling is capped at 1 req/s per task.
Pricing
Published price — no tokens, no invented credits. A failed task is never charged.
Errors
| HTTP | Code | Meaning |
|---|---|---|
401 | unauthorized | Missing or invalid API key. |
402 | insufficient_balance | Your balance doesn't cover the task price. |
404 | unknown_type | That task type doesn't exist. |
429 | rate_limited | Too many requests. Use the webhook instead of polling. |
Technical notes
Unlike classic Base64, the output never contains plus or slash characters and never ends with equals padding, so tokens survive query strings, path segments, and JSON without extra escaping. Pick encode to turn a message, claim set, or configuration string into a compact Base64url payload, or pick decode to recover the original text from a URL-safe token you already hold.
What Base64url is and what this tool returns
The JSON response includes result for the transformed string, mode echoing encode or decode, encoding fixed to base64url, and input_bytes plus output_bytes so you can assert sizes in tests. There is no streaming path and no silent fallback to the classic alphabet: either the string is valid Base64url text or the request fails with invalid_input. If you need padded standard Base64 with plus and slash, use a dedicated standard Base64 endpoint; this landing is only for the URL-safe, no-padding contract that JWT and many modern APIs already expect.
How text and mode are read and how results stay reproducible
Encode accepts any Unicode string, converts it with the platform TextEncoder to UTF-8 bytes, then emits Base64url without padding. Decode requires a pure Base64url string: length mod four equal to one is rejected because it cannot represent a whole number of bytes, and any character outside the URL-safe alphabet fails with a clear message that points at plus, slash, or equals when those standard Base64 symbols appear. After bytes are recovered, a fatal UTF-8 decode ensures binary garbage does not become mojibake text. The preferred payload field is text, with aliases input, value, and s so forms, query strings, and SDK clients can reuse the same contract without renaming columns. Mode defaults to encode and accepts decode explicitly; aliases op, direction, and action map to the same switch for scripts that already use those names. Pair the free browser run on this page with the priced API when you need the identical mathematical result inside an automated pipeline without re-implementing Base64url tables yourself. Invalid inputs return invalid_input and are not charged, which keeps validation cheap while successful transforms remain a fixed item price.
Where Base64url fits in tokens, APIs, and test fixtures
On this page the work runs entirely in your browser; through the API each successful lookup costs $0.002, failed validation is not charged, and nothing is stored after the response returns. That split — free interactive exploration and a priced, identical API — matches the rest of the KIT tier-A catalog and lets you move from a classroom demo to an automated pipeline without changing the encoded result. Pair it with JWT or hash helpers when you need related crypto steps, and with other encoding endpoints when you are building a small lab of free, deterministic text tools.
Integration use cases
Query-string safe payloads
Turn short text into Base64url so it survives query parameters and path segments without percent-encoding surprises.
Deterministic CI fixtures
Generate reproducible Base64url strings for unit tests, golden files, and contract checks across services.
Technical questions
What modes are supported?
mode=encode (default) turns plain text into Base64url. mode=decode turns a Base64url string back into UTF-8 text.