Editing Base64 (section)

===URL applications===
Base64 encoding can be helpful when fairly lengthy identifying information is used in an HTTP environment. For example, a database persistence framework for [[Java (programming language)|Java]] objects might use Base64 encoding to encode a relatively large unique id (generally 128-bit [[UUID]]s) into a string for use as an HTTP parameter in HTTP forms or HTTP GET [[URL]]s. Also, many applications need to encode binary data in a way that is convenient for inclusion in URLs, including in hidden web form fields, and Base64 is a convenient encoding to render them in a compact way.

Using standard Base64 in [[URL]] requires encoding of '<code>+</code>', '<code>/</code>' and '<code>=</code>' characters into special [[percent-encoding|percent-encoded]] hexadecimal sequences ('<code>+</code>' becomes '<code>%2B</code>', '<code>/</code>' becomes '<code>%2F</code>' and '<code>=</code>' becomes '<code>%3D</code>'), which makes the string unnecessarily longer.

For this reason, '''modified Base64 for URL''' variants exist (such as  '''base64url''' in {{IETF RFC|4648}}), where the '<code>+</code>' and '<code>/</code>' characters of standard Base64 are respectively replaced by '<code>-</code>' and '<code>_</code>', so that using [[percent-encoding|URL encoders/decoders]] is no longer necessary and has no effect on the length of the encoded value, leaving the same encoded form intact for use in relational databases, web forms, and object identifiers in general. A popular site to make use of such is [[YouTube#Uploading|YouTube]].<ref>{{cite web |title=Here's Why YouTube Will Practically Never Run Out of Unique Video IDs |url=https://www.mentalfloss.com/article/77598/heres-why-youtube-will-never-run-out-unique-video-ids |website=www.mentalfloss.com |access-date=27 December 2021 |language=en |date=23 March 2016}}</ref> Some variants allow or require omitting the padding '<code>=</code>' signs to avoid them being confused with field separators, or require that any such padding be percent-encoded. Some libraries {{which|date=December 2020}} will encode '<code>=</code>' to '<code>.</code>', potentially exposing applications to relative path attacks when a folder name is encoded from user data.{{Citation needed|date=June 2022}}