UTF-8 to Base64URL Converter Guide (2026)

To convert UTF-8 to Base64URL, follow 4 steps: (1) encode text to UTF-8 bytes, (2) apply standard Base64, (3) swap + → - and / → _, (4) strip trailing = padding. This produces a URL-safe string per RFC 4648, used in JWTs and API headers.

Standard Base64 vs. Base64URL

Per RFC 4648 §5, this “URL and Filename Safe Alphabet” ensures cross-system compatibility.

The 4-Step Conversion Process

Base64 encoding increases data size by ~33% per Wikipedia.

Unicode and Emoji Handling

Per NextUtils, Base64 is encoding, not encryption — it moves data through text-only channels. To handle Unicode/emoji without corruption (“Mojibake”), always use TextEncoder to convert to UTF-8 bytes first.

Code Examples

JavaScript (Browser) — Unicode-Safe

function toBase64Url(str) {
    const bytes = new TextEncoder().encode(str);
    const base64 = btoa(String.fromCharCode(...bytes));
    return base64.replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
}

Python 3 — Standard Library

Per AskPython:

import base64

data = "Hello 世界! 🌍"
encoded = base64.urlsafe_b64encode(data.encode('utf-8')).decode('utf-8').rstrip('=')
print(encoded)

Node.js — Buffer Conversion

const str = "API_Payload_Data";
const base64url = Buffer.from(str, 'utf8')
    .toString('base64')
    .replace(/\+/g, '-')
    .replace(/\//g, '_')
    .replace(/=/g, '');

Troubleshooting: Padding Errors

Per AskPython, calculate missing padding: padding_needed = (4 - len(data) % 4) % 4, then append that many = characters.

Use Cases: JWT and Data URIs

JWT (JSON Web Token) Structure

JWTs often start with eyJ — the Base64URL encoding of { (opening JSON bracket).

Base64 vs. Base64URL by Use Case

Conclusion

4 steps: UTF-8 bytes → Base64 → swap +/ to -_ → strip padding. Use TextEncoder in JavaScript, base64.urlsafe_b64encode() in Python, Buffer in Node.js. Follow RFC 4648 for cross-system compatibility. Base64URL is encoding, not encryption — use AES-256 or TLS for security.

FAQ

Is Base64URL the same as encryption?

No. Base64URL is reversible encoding — anyone can decode it without a key. Use AES-256 or TLS/SSL for securing sensitive data.

Why does Base64URL fail in a standard Base64 decoder?

Standard decoders expect +, /, and = padding. Base64URL uses -, _, and omits padding. Reverse the character swaps and restore padding before decoding.

Why is padding omitted in JWTs?

The = character becomes %3D in URLs, making strings longer and harder to read. RFC 4648 allows omission because decoders can reconstruct the original length without padding markers.