String based data encoding: Base64 vs Base64url

Question

What is the difference between Base64 and Base64url that I see in things like JSON web tokens?

Answer 1

Both Base64 and Base64url are ways to encode binary data in string form. You can read about the theory of base64 here. The problem with Base64 is that it contains the characters +, /, and =, which have a reserved meaning in some filesystem names and URLs. So base64url solves this by replacing + with - and / with _. The trailing padding character = can be eliminated when not needed, but in a URL it would instead most likely be % URL encoded. Then the encoded data can be included in a URL without problems.

Here is a chart of the differences:

Index  Base64  Base64Url  0      A       A  1      B       B  2      C       C  3      D       D  4      E       E  5      F       F  6      G       G  7      H       H  8      I       I  9      J       J  10     K       K  11     L       L  12     M       M  13     N       N  14     O       O  15     P       P  16     Q       Q  17     R       R  18     S       S  19     T       T  20     U       U  21     V       V  22     W       W  23     X       X  24     Y       Y  25     Z       Z  26     a       a  27     b       b  28     c       c  29     d       d  30     e       e  31     f       f  32     g       g  33     h       h  34     i       i  35     j       j  36     k       k  37     l       l  38     m       m  39     n       n  40     o       o  41     p       p  42     q       q  43     r       r  44     s       s  45     t       t  46     u       u  47     v       v  48     w       w 49     x       x 50     y       y 51     z       z 52     0       0 53     1       1 54     2       2 55     3       3 56     4       4 57     5       5 58     6       6 59     7       7 60     8       8 61     9       9 62     +       - 63     /       _                =       (optional) 

Below I will quote the definitions from the standards.

RCF 4648 specs

4. Base 64 Encoding

The following description of base 64 is derived from 3, [4], [5], and [6]. This encoding may be referred to as "base64".

The Base 64 encoding is designed to represent arbitrary sequences of octets in a form that allows the use of both upper- and lowercase letters but that need not be human readable.

A 65-character subset of US-ASCII is used, enabling 6 bits to be
represented per printable character. (The extra 65th character, "=", is used to signify a special processing function.)

The encoding process represents 24-bit groups of input bits as output strings of 4 encoded characters. Proceeding from left to right, a 24-bit input group is formed by concatenating 3 8-bit input groups. These 24 bits are then treated as 4 concatenated 6-bit groups, each of which is translated into a single character in the base 64 alphabet.

Each 6-bit group is used as an index into an array of 64 printable characters. The character referenced by the index is placed in the
output string.

                  Table 1: The Base 64 Alphabet   Value Encoding  Value Encoding  Value Encoding  Value Encoding      0 A            17 R            34 i            51 z      1 B            18 S            35 j            52 0      2 C            19 T            36 k            53 1      3 D            20 U            37 l            54 2      4 E            21 V            38 m            55 3      5 F            22 W            39 n            56 4      6 G            23 X            40 o            57 5      7 H            24 Y            41 p            58 6      8 I            25 Z            42 q            59 7      9 J            26 a            43 r            60 8     10 K            27 b            44 s            61 9     11 L            28 c            45 t            62 +     12 M            29 d            46 u            63 /     13 N            30 e            47 v     14 O            31 f            48 w         (pad) =     15 P            32 g            49 x     16 Q            33 h            50 y 

Special processing is performed if fewer than 24 bits are available at the end of the data being encoded. A full encoding quantum is
always completed at the end of a quantity. When fewer than 24 input
bits are available in an input group, bits with value zero are added
(on the right) to form an integral number of 6-bit groups. Padding
at the end of the data is performed using the '=' character. Since
all base 64 input is an integral number of octets, only the following cases can arise:

(1) The final quantum of encoding input is an integral multiple of 24 bits; here, the final unit of encoded output will be an integral multiple of 4 characters with no "=" padding.

(2) The final quantum of encoding input is exactly 8 bits; here, the final unit of encoded output will be two characters followed by two "=" padding characters.

(3) The final quantum of encoding input is exactly 16 bits; here, the final unit of encoded output will be three characters followed by one "=" padding character.

5. Base 64 Encoding with URL and Filename Safe Alphabet

The Base 64 encoding with an URL and filename safe alphabet has been used in [12].

An alternative alphabet has been suggested that would use "~" as the 63rd character. Since the "~" character has special meaning in some file system environments, the encoding described in this section is recommended instead. The remaining unreserved URI character is ".", but some file system environments do not permit multiple "." in a filename, thus making the "." character unattractive as well.

The pad character "=" is typically percent-encoded when used in an URI [9], but if the data length is known implicitly, this can be
avoided by skipping the padding; see section 3.2.

This encoding may be referred to as "base64url". This encoding
should not be regarded as the same as the "base64" encoding and
should not be referred to as only "base64". Unless clarified
otherwise, "base64" refers to the base 64 in the previous section.

This encoding is technically identical to the previous one, except for the 62:nd and 63:rd alphabet character, as indicated in Table 2.

     Table 2: The "URL and Filename safe" Base 64 Alphabet   Value Encoding  Value Encoding  Value Encoding  Value Encoding      0 A            17 R            34 i            51 z      1 B            18 S            35 j            52 0      2 C            19 T            36 k            53 1      3 D            20 U            37 l            54 2      4 E            21 V            38 m            55 3      5 F            22 W            39 n            56 4      6 G            23 X            40 o            57 5      7 H            24 Y            41 p            58 6      8 I            25 Z            42 q            59 7      9 J            26 a            43 r            60 8     10 K            27 b            44 s            61 9     11 L            28 c            45 t            62 - (minus)     12 M            29 d            46 u            63 _     13 N            30 e            47 v           (underline)     14 O            31 f            48 w     15 P            32 g            49 x     16 Q            33 h            50 y         (pad) =