Base64 vs Base64url: Why `+`, `/`, and `=` Break URLs, and Why JWTs Use a Different Alphabet
Standard Base64's `+`, `/`, and `=` characters all have special meaning in URLs — which is why a Base64-encoded JWT pasted directly into a URL can silently corrupt, and why Base64url exists as a separate, URL-safe alphabet. Here's exactly which characters differ, why JWTs require Base64url specifically, how padding works and why Base64url commonly omits it, and how to tell the two variants apart.