demo · v140

Alphabet Explorer

The new methods accept an alphabet option. Type something on the left, switch between the standard alphabet and base64url (URL-safe), watch the trailing characters and padding shift. Crucial when you ship binary tokens through URLs and headers.

standard (base64)

base64url (no pad)

const bytes = new TextEncoder().encode("???>>~~~");

bytes.toBase64();                              // "Pz8/Pj5+fn4="
bytes.toBase64({ alphabet: "base64url" });     // "Pz8_Pj5-fn4="
bytes.toBase64({ alphabet: "base64url",
                 omitPadding: true });         // "Pz8_Pj5-fn4"

// Decoding accepts both, controlled by the same alphabet option.
Uint8Array.fromBase64("Pz8_Pj5-fn4",
                      { alphabet: "base64url" });

why two alphabets

Standard base64 uses +, / and = padding. All three are reserved or magic inside URLs and HTTP headers. base64url swaps them for -, _ and (optionally) drops padding. Without a built-in switch you'd be hand-replacing characters before and after every call — the cause of most "looks like base64 but the server can't decode it" bugs. Tokens from WebAuthn, JWT, OAuth state parameters, and webpush subscriptions all expect base64url.

see also