String based data encoding: Base64 vs Base64url

What is the difference between Base64 and Base64url that I see in things like JSON web tokens?

Both Base64 and Base64url are ways to encode binary data in string form. You can read about the theory of base64 here. The problem with Base64 is that it contains the characters +, /, and =, which have a reserved meaning in some filesystem names and URLs. So base64url solves this by replacing + with - and / with _. The trailing padding character = can be eliminated when not needed, but in a URL it would instead most likely be % URL encoded. Then the encoded data can be included in a URL without problems.

Here is a chart of the differences:

Index  Base64  Base64Url

0      A       A 
1      B       B 
2      C       C 
3      D       D 
4      E       E 
5      F       F 
6      G       G 
7      H       H 
8      I       I 
9      J       J 
10     K       K 
11     L       L 
12     M       M 
13     N       N 
14     O       O 
15     P       P 
16     Q       Q 
17     R       R 
18     S       S 
19     T       T 
20     U       U 
21     V       V 
22     W       W 
23     X       X 
24     Y       Y 
25     Z       Z 
26     a       a 
27     b       b 
28     c       c 
29     d       d 
30     e       e 
31     f       f 
32     g       g 
33     h       h 
34     i       i 
35     j       j 
36     k       k 
37     l       l 
38     m       m 
39     n       n 
40     o       o 
41     p       p 
42     q       q 
43     r       r 
44     s       s 
45     t       t 
46     u       u 
47     v       v 
48     w       w
49     x       x
50     y       y
51     z       z
52     0       0
53     1       1
54     2       2
55     3       3
56     4       4
57     5       5
58     6       6
59     7       7
60     8       8
61     9       9
62     +       -
63     /       _
       
       =       (optional)

Below I will quote the definitions from the standards.

RCF 4648 specs

> 4. Base 64 Encoding > > The following description of base 64 is derived from 3, [4], [5], > and [6]. This encoding may be referred to as "base64". > > The Base 64 encoding is designed to represent arbitrary sequences > of octets in a form that allows the use of both upper- and > lowercase letters but that need not be human readable. > > A 65-character subset of US-ASCII is used, enabling 6 bits to be
> represented per printable character. (The extra 65th character, "=", > is used to signify a special processing function.) > > The encoding process represents 24-bit groups of input bits as > output strings of 4 encoded characters. Proceeding from left to > right, a 24-bit input group is formed by concatenating 3 8-bit > input groups. These 24 bits are then treated as 4 concatenated > 6-bit groups, each of which is translated into a single character > in the base 64 alphabet. > > Each 6-bit group is used as an index into an array of 64 printable > characters. The character referenced by the index is placed in the
> output string. > > Table 1: The Base 64 Alphabet > > Value Encoding Value Encoding Value Encoding Value Encoding > 0 A 17 R 34 i 51 z > 1 B 18 S 35 j 52 0 > 2 C 19 T 36 k 53 1 > 3 D 20 U 37 l 54 2 > 4 E 21 V 38 m 55 3 > 5 F 22 W 39 n 56 4 > 6 G 23 X 40 o 57 5 > 7 H 24 Y 41 p 58 6 > 8 I 25 Z 42 q 59 7 > 9 J 26 a 43 r 60 8 > 10 K 27 b 44 s 61 9 > 11 L 28 c 45 t 62 + > 12 M 29 d 46 u 63 / > 13 N 30 e 47 v > 14 O 31 f 48 w (pad) = > 15 P 32 g 49 x > 16 Q 33 h 50 y > > Special processing is performed if fewer than 24 bits are available > at the end of the data being encoded. A full encoding quantum is
> always completed at the end of a quantity. When fewer than 24 input
> bits are available in an input group, bits with value zero are added
> (on the right) to form an integral number of 6-bit groups. Padding
> at the end of the data is performed using the '=' character. Since
> all base 64 input is an integral number of octets, only the following > cases can arise: > > (1) The final quantum of encoding input is an integral multiple of > 24 > bits; here, the final unit of encoded output will be an integral > multiple of 4 characters with no "=" padding. > > (2) The final quantum of encoding input is exactly 8 bits; here, > the > final unit of encoded output will be two characters followed by > two "=" padding characters. > > (3) The final quantum of encoding input is exactly 16 bits; here, > the > final unit of encoded output will be three characters followed by > one "=" padding character. > > 5. Base 64 Encoding with URL and Filename Safe Alphabet > > The Base 64 encoding with an URL and filename safe alphabet has > been used in [12]. > > An alternative alphabet has been suggested that would use "" as > the 63rd character. Since the "" character has special meaning in > some file system environments, the encoding described in this > section is recommended instead. The remaining unreserved URI > character is ".", but some file system environments do not permit > multiple "." in a filename, thus making the "." character > unattractive as well. > > The pad character "=" is typically percent-encoded when used in an > URI [9], but if the data length is known implicitly, this can be
> avoided by skipping the padding; see section 3.2. > > This encoding may be referred to as "base64url". This encoding
> should not be regarded as the same as the "base64" encoding and
> should not be referred to as only "base64". Unless clarified
> otherwise, "base64" refers to the base 64 in the previous section. > > This encoding is technically identical to the previous one, except > for the 62:nd and 63:rd alphabet character, as indicated in Table 2. > > Table 2: The "URL and Filename safe" Base 64 Alphabet > > Value Encoding Value Encoding Value Encoding Value Encoding > 0 A 17 R 34 i 51 z > 1 B 18 S 35 j 52 0 > 2 C 19 T 36 k 53 1 > 3 D 20 U 37 l 54 2 > 4 E 21 V 38 m 55 3 > 5 F 22 W 39 n 56 4 > 6 G 23 X 40 o 57 5 > 7 H 24 Y 41 p 58 6 > 8 I 25 Z 42 q 59 7 > 9 J 26 a 43 r 60 8 > 10 K 27 b 44 s 61 9 > 11 L 28 c 45 t 62 - (minus) > 12 M 29 d 46 u 63 _ > 13 N 30 e 47 v (underline) > 14 O 31 f 48 w > 15 P 32 g 49 x > 16 Q 33 h 50 y (pad) =