Standard Web & Spécification RFC

Base64 vs Base64URL — Différences Clés Expliquées

Base64 vs Base64URL expliqué. Caractères, padding, quand utiliser chacun (JWT, OAuth, URLs). RFC 4648 §4 vs §5.

Pourquoi le Base64 standard pose problème dans les URL

Standard Base64 (RFC 4648 §4) uses the 64-character alphabet A-Z, a-z, 0-9, +, /, with = used as trailing byte padding.

However, when standard Base64 strings are passed in HTTP query parameters, URI path segments, or web cookies:

  • The plus sign + is automatically interpreted by web servers as a space character (%20), corrupting the payload.
  • The forward slash / is interpreted by web routers as a path delimiter, altering URL routing logic.
  • The equals sign = is used as a key-value parameter separator in query strings.

Substitutions de caractères de l'alphabet (RFC 4648 §5)

FeatureStandard Base64Base64URL (URL-Safe)
Index 62+ (plus)- (hyphen)
Index 63/ (slash)_ (underscore)
Padding Character (=)Mandatory (Length % 4 == 0)Omitted or Unpadded

Essayer les outils en ligne

Need to convert between Base64 formats? Use our suite of 100% client-side tools: