Hex to Base64URL Converter
Convert a hexadecimal string to URL-safe Base64URL (RFC 4648 §5). Accepts 0x prefixes and spaced hex like 68 65 6c 6c 6f — with the byte grouping and padding options shown step by step.
100% client-side · zero network requests · batch modeBase64URL output
Conversion stages
| Input | Base64URL | Bytes | Status |
|---|---|---|---|
| Paste values and press “Convert all”. | |||
Worked examples
| Hex input | Bytes | Standard Base64 | Base64URL output | What changed |
|---|---|---|---|---|
| 68656c6c6f | 68 65 6c 6c 6f ("hello") | aGVsbG8= | aGVsbG8 | Padding stripped |
| deadbeef | de ad be ef | 3q2+7w== | 3q2-7w | + became -, padding stripped |
| ff | ff | /w== | _w | / became _, padding stripped |
| 48656c6c6f20576f726c64 | 48 65 6c 6c 6f 20 57 6f 72 6c 64 ("Hello World") | SGVsbG8gV29ybGQ= | SGVsbG8gV29ybGQ | Padding stripped |
| f09f98bb | f0 9f 98 bb (emoji bytes) | 8J+Yuw== | 8J-Yuw | + became -, padding stripped |
| 0102030405060708 | 01 02 03 04 05 06 07 08 | AQIDBAUGBwg= | AQIDBAUGBwg | Padding stripped |
| aabbcc | aa bb cc | qrvM | qrvM | Already a multiple of 4 — nothing to strip |
| 0000 | 00 00 | AAA= | AAA | Padding stripped |
How hex becomes Base64URL
Hexadecimal is just a readable way to write raw bytes: every two hex digits are one byte. Base64 then packs those bytes three at a time into four text characters. The final URL-safe step swaps the two characters that are illegal in URLs (+ and /) for - and _, and usually drops the = padding. That is the whole pipeline — byte grouping, standard Base64, alphabet swap — and the result box above shows all three stages for your input.
This is the format JWT signatures, OAuth code_challenge values, and many API tokens use: a SHA-256 HMAC digest in hex is 64 characters, while the same digest in base64url is only 43, and it can be pasted straight into a URL or header.
Do it in code
import base64 h = "deadbeef" base64.urlsafe_b64encode(bytes.fromhex(h)).rstrip(b"=").decode() # '3q2-7w'
Buffer.from("deadbeef", "hex").toString("base64url");
// '3q2-7w'
echo -n deadbeef | xxd -r -p | base64 | tr '+/' '-_' | tr -d '=' # 3q2-7w
Frequently asked questions
When would I convert hex to base64url instead of plain base64?
Whenever the encoded value travels inside a URL, a JWT, an OAuth parameter, or an HTTP header. Typical cases: turning an HMAC or SHA-256 digest from hex into a compact token-safe string, formatting a crypto key for a JWKS or API credential, or building a PKCE code_challenge for OAuth. Standard base64 contains plus, slash, and equals characters that break URLs unless percent-encoded; base64url avoids that entirely.
How does the hex to base64url conversion actually work?
Three steps. First, each pair of hex digits becomes one byte, so 68656c6c6f becomes the five bytes 68 65 6c 6c 6f. Second, those bytes are encoded as standard base64, which gives aGVsbG8=. Third, the URL-unsafe characters are swapped: plus becomes minus, slash becomes underscore, and the padding equals signs are stripped, giving aGVsbG8. This tool shows all three stages so you can verify each one.
What is the difference between standard Base64 and Base64URL?
The encoding math is identical; only the alphabet differs. Base64URL, defined in RFC 4648 section 5, replaces plus with minus and slash with underscore, and padding with equals signs is usually omitted. Example: the hex deadbeef encodes to 3q2+7w== in standard base64 but to 3q2-7w in base64url. If your system expects plain base64, use the standard hex to base64 tool instead.
Should I keep the = padding or strip it?
It depends on the consumer. RFC 4648 allows omitting padding in base64url, and JWT, JWS, and most OAuth flows strip it, which is why this tool strips padding by default. Some strict parsers still require the padding to reach a multiple of 4 characters. Select keep padding above if your API documentation shows trailing equals signs; the output then matches standard length rules.
Which hex formats does this converter accept?
Uppercase or lowercase, with or without a 0x prefix, and with any whitespace for readability, such as 68 65 6c 6c 6f or line breaks pasted from a hex dump. The only hard rule is that the cleaned string must contain an even number of hex digits, because one byte is exactly two digits. Non-hex characters are rejected with the exact position of the bad character.
Why do I get an odd length error for my hex string?
An odd number of hex digits cannot form whole bytes, so the input is ambiguous rather than convertible. The usual fix is a single leading zero: abc becomes 0abc, which is two bytes, 0a bc. Copying a hash from a document sometimes drops a leading zero, so check the start of the string first.
Can I convert many hex strings at once?
Yes. Open the Batch tab and paste one hex value per line, in any accepted format. The tool builds a table with the base64url output, byte count, and status for each line, flags invalid lines with their exact error, and lets you copy the whole table as tab-separated values for spreadsheets.
Is my input sent to a server? Is this converter private?
No, nothing leaves your browser. All conversion happens in JavaScript on this page, with zero network requests for the encoding itself, so it keeps working even if you disconnect after the page loads. That makes it safe for pasting secrets, HMAC keys, and token material you would never upload to an online service.
How do I convert hex to base64url in Python, JavaScript, or the terminal?
Python: base64.urlsafe_b64encode(bytes.fromhex(h)).rstrip(b"=").decode(). JavaScript: Buffer.from(h, hex).toString(base64url) in Node, or btoa with a manual plus-slash swap in the browser. Terminal: echo -n 68656c6c6f | xxd -r -p | base64 | tr +/ -_ | tr -d =. All three produce the same result as this tool, which is useful for scripting the conversion.
Related tools
Free tool by NRTechStudio