Base64URL

Standard base64 uses + and /, both special in URLs. Base64url (RFC 4648 §5):

• + becomes -
• / becomes _
• Padding = is OPTIONAL (often dropped to save chars)

Standard:  SGVsbG8gV29ybGQ=
Base64url: SGVsbG8gV29ybGQ    (no padding)
Or:        SGVsbG8gV29ybGQ=   (with padding)

Used in:

• JWT (header.payload.signature)
• URLs containing data
• File paths

Decoders must:

1. Replace - with + and _ with /
2. Add back the appropriate = padding (based on length % 4)
3. Decode as standard base64

Other variants:

• Base32 (RFC 4648 §6): A-Z + 2-7, case-insensitive. Used for OTP secrets, Bitcoin addresses.
• Base16 = hex.
• Base58 (Bitcoin): no 0, O, I, l to avoid visual confusion.
• Ascii85 / Base85: more efficient than base64 (5 chars per 4 bytes vs 4 per 3).