Base64URL and Standard Base64: JWTs, Padding, and Safe Transport
Three Base64-looking blobs in a JWT are not generic Base64—they omit padding and swap characters for URL safety. Misunderstanding that distinction wastes hours in decoder errors and signature mismatches.
Alphabet swaps and where they appear
Base64URL maps `+` to `-` and `/` to `_`. When pasting JWT segments into generic Base64 decoders, translate first or rely on JWT-aware libraries that accept raw segments.
JWT structure and verification
Read claims with JWT fundamentals in mind—never trust unsigned payloads, and cross-check alg headers against your validation keys.
Escaping layers: URL vs HTML
Base64 solves binary-in-text; percent-encoding solves reserved URL characters. Do not stack strategies blindly—see URL encoding vs HTML entities and contrast with standard Base64 for attachments and email.
Decoding safely in browsers and servers
`atob` expects standard Base64; JWT libraries handle URL-safe variants internally. Never hand-roll decode without unit tests on edge lengths—off-by-one padding bugs become authentication bypasses in the worst case, not just garbled JSON.
Signature input canonicalization
HMAC and ECDSA verify over the exact ASCII of `base64url(header).base64url(payload)`—re-encoding with different padding or JSON key order breaks verification even when payloads are semantically identical. Pin library versions that serialize claims deterministically.
Debugging tokens without leaking secrets
Redact bearer tokens in logs; decode locally with trusted tools. When sharing repro steps, rotate the token afterward—screenshots of JWTs in Slack are effectively password leaks if the signing key is ever exposed.
Recommended tools
Encode and decode with padding awareness.
Inspect header and payload segments safely.
Percent-encode tokens in query strings.
Prototype signature checks for webhooks.
Related guides
Frequently Asked Questions
What is Base64URL?
A variant that replaces `+`/`/` and strips padding `=` so strings are safe in URLs and JWT segments without extra encoding.
Why do JWT parts look like Base64 but fail in decoders?
JWT uses Base64URL, not standard Base64—translate characters before decoding or use libraries that handle both.
Is padding required?
In Base64URL for JWT, padding is typically omitted; decoders must accept unpadded input per RFC 7515.
How does HMAC fit in?
Signatures are computed over the exact bytes of header and payload—verify with constant-time compares using our HMAC tools.
Why does copying a JWT into a standard Base64 decoder fail?
Character set differs—translate `-`→`+` and `_`→`/` (and pad) or use a Base64URL-aware library end to end.
Are JWE segments Base64URL too?
Yes—authenticated encryption payloads follow the same alphabet; treat each part as opaque bytes until decrypted.
Wrapping up
Name the encoding before you decode—Base64URL for JWT segments, standard Base64 elsewhere, and never mix layers without a clear contract.
Base64 →