Base64 URL-safe vs Standard Guide
Choose the correct Base64 variant for query params, tokens, and transport protocols.
1. Standard Base64 uses `+` and `/`, URL-safe uses `-` and `_`.
2. Keep padding rules explicit when exchanging across systems.
3. Normalize variant before signature or checksum calculations.
4. Avoid double-encoding values before URL transport.
5. Validate decoder behavior for missing padding edge cases.
6. Document expected variant in every API contract.
Implementation notes
Treat Base64 variant as a contract-level concern, not an implementation detail. Most production bugs come from mixed assumptions between signing, transport, and decoding services.
Related pages
FAQ
Can I remove padding safely? Only if both producer and consumer explicitly support unpadded decoding.
Should URL-safe always be used in query strings? Usually yes, because it avoids reserved URL characters.