Base64 & Encoding Cheat Sheet
The rules worth remembering, and the ones people get wrong most often. Same figures this tool uses.
BFCBrilliance · bfcbrilliance.com/tools/base64-encoder-decoder
The numbers
- Alphabet size
- 64 characters
- Standard alphabet
- A-Z a-z 0-9 + /
- URL-safe alphabet
- A-Z a-z 0-9 - _
- Input per block
- 3 bytes
- Output per block
- 4 characters
- Size increase
- about 33%
- Padding character
- =
Before you reach for Base64
- Am I moving data through a text-only channel? That's what it's for
- Am I trying to hide something? Base64 is not encryption - use encryption
- Does the receiver expect standard or URL-safe? They are not interchangeable
- Will the 33% size increase matter here?
- Is the data already text that would survive as-is? Then skip it
The mistake that costs the most time
A JWT is three Base64URL sections separated by dots. Decoding one with a standard decoder often fails, because - and _ are not valid in standard Base64 and the padding has been stripped. Convert - back to +, _ back to /, then add = until the length divides by 4.