The Role of Base64URL in JWTs
A JSON Web Token (JWT) is a compact, URL-safe means of representing claims between two parties. To ensure JWT tokens can be safely transmitted inside HTTP headers, query parameters, or cookies without being modified or corrupted by web proxies, the token standard uses Base64URL encoding.
Standard Base64 contains + and / characters, which have special meanings in URLs. Base64URL replaces + with -, / with _, and strips trailing = padding.
The Three Parts of a JWT
JWT Structure:
Header (Base64URL) . Payload (Base64URL) . Signature (Base64URL)
Example: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIn0.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
Base64 Encoding Is NOT Encryption!
A common security misconception is assuming a JWT's contents are encrypted because they look scrambled. Base64URL is simple encoding, not encryption. Anyone who captures a JWT can decode and read its header and payload instantly using our JWT Decoder Tool or Base64 Guide. Never store sensitive passwords or unencrypted secrets in a JWT payload.