Base64url encoding

As explained in Secure APIs

Base64url encoding is a variant of base64 encoding that replaces URL-sensitive characters and omits padding for safe use in URLs.

Base64url encoding is a URL-safe variant of base64. It replaces + with - and / with _, then omits = padding, avoiding URL-sensitive characters and unnecessary percent encoding. section 7.2.2

A JWT applies base64url encoding to its header, payload, and signature, joining the three encoded parts with dots. The encoding changes representation; it does not itself provide signing or confidentiality. section 7.2.2

JWT representation

A JWT can appear as three URL-safe segments: an encoded JOSE header, an encoded payload containing claims, and an encoded signature. A certificate-bound token can also carry a base64url-encoded certificate thumbprint in the cnf.x5t#S256 claim. section 7.2.2 section 7.5.1

Figure 7.2 To produce a JWT, we base64url encode the header, payload, and signature, and we join them with dots as separators.

Shows how base64url-encoded JWT components are concatenated with dots to form a token. section 7.2.2

How Secure APIs covers it

How deep it goes

Defines the character substitutions and omitted padding, then applies them to JWT parts and certificate thumbprints without implementation internals.

Examples

Uses JWT header, payload, signature, and certificate-thumbprint claim examples.

What you can do after

Evaluate how JWT segments and certificate-thumbprint claims are represented as URL-safe encoded values.

How it connects

Connects base64 encoding with JSON Web Tokens, JOSE headers, digital certificates, certificate thumbprints, and mutual TLS.

liveBookmanning.com

Read Secure APIs on liveBook Get the book at manning.com

Related concepts

• Base64alternative to · Base64 is a binary-to-text encoding scheme that represents arbitrary bytes using a fixed 64-character alphabet and provides no confidentiality.
• JSON Web Tokenuses · A JSON Web Token is a compact, URL-safe representation of claims encoded as a JSON object and protected by a digital signature, message authentication code, or encryption.
• code challengeproduces · A code challenge is a client-generated value derived from a PKCE code verifier and sent in an authorization request to prove possession later.

This explainer was generated by Manning's knowledge graph from the text of Secure APIs. The section links point to the parts of the book it draws on.