Base64 and URL encoding explained

Strings of odd letters and % signs in an email source, an API response or an address bar are usually Base64 or URL encoding. Both exist to carry data safely, not to hide it.

What is Base64?

Base64 turns binary data (images, files, keys) into text made only of letters, digits, + and /. That way the data travels intact through text-only channels such as email or JSON. The price is about a third more size.

Base64 is not encryption

Anyone can reverse Base64 in one step. Storing a password, API key or personal data “safely in Base64” is a serious mistake.

Base64URL

The + and / characters of standard Base64 have special meanings in addresses. Base64URL uses - and _ instead and drops trailing = signs. Tokens such as JWTs use this form.

URL encoding

Spaces, &, ? and accented letters cannot appear raw in addresses; they become sequences like %20 and %26. When adding a search term as a parameter, encode all of it. Encoding a value twice (like %2520) is a common mistake that shows up when decoding.

The Base64 and URL encoder/decoder uses UTF-8, so accented characters stay intact.