Java Base64 URL encoding: choose the alphabet at the transport boundary

Match the receiving protocol

A short binary marker demonstrates the difference without printing a credential. The basic alphabet uses plus and slash, while the URL alphabet substitutes hyphen and underscore. Removing padding changes text length, not the decoded bytes.

A receiver must use the matching decoder and reject malformed input rather than silently trying several formats. Random token encoding uses the URL-safe form because bearer tokens often travel through URL-compatible fields.

Do not give encoding a security role

Anyone holding a Base64 value can decode it. Encrypt sensitive content with an authenticated scheme when confidentiality is required; AES-GCM covers that separate operation. Put limits on encoded length before decoding untrusted fields.

Working program

import java.util.Arrays;
import java.util.Base64;

public class BinaryMarkerAlphabets {
    public static void main(String[] args) {
        byte[] marker = { (byte) 0xfb, (byte) 0xff };
        String basic = Base64.getEncoder().encodeToString(marker);
        String url = Base64.getUrlEncoder().withoutPadding().encodeToString(marker);
        System.out.println("basic=" + basic);
        System.out.println("url=" + url);
        System.out.println("same=" + Arrays.equals(marker, Base64.getUrlDecoder().decode(url)));
    }
}

Output

basic=+/8=
url=-_8
same=true

Cost and ownership

Encoding and decoding process O(n) bytes and allocate output proportional to input length. A transport-safe alphabet is a formatting decision; it does not add secrecy, integrity or source authentication.

Common Mistakes

• Do not treat Base64 as encryption.
• Do not feed URL-alphabet input to a basic decoder without a protocol rule.
• Do not decode unbounded input into memory.

Read next

Java SecureRandom token encoding: preserve unpredictable bytes in a URL-safe form, Java AES-GCM: reject a changed ciphertext before accepting plaintext, Java byte streams: partial reads and bounded copying, Java SHA-256: hash declared bytes, not an implicit string encoding.