Decode base64Url in Java

Question

https://web.archive.org/web/20110422225659/https://en.wikipedia.org/wiki/Base64#URL_applications

talks about base64Url - Decode

a modified Base64 for URL variant exists, where no padding '=' will be used, and the '+' and '/' characters of standard Base64 are respectively replaced by '-' and '_'

I created the following function:

public static String base64UrlDecode(String input) {
    String result = null;
    BASE64Decoder decoder = new BASE64Decoder();
    try {
        result = decoder.decodeBuffer(input.replace('-','+').replace('/','_')).toString();
    }
    catch (IOException e) {
        System.out.println(e.getMessage());
    }
    return result;
}

it returns a very small set of characters that don't even resemble to the expected results. any ideas?

You shouldn't use `sun.misc.BASE64Decoder` because it is internal Sun/Oracle code (not part of J2SE) and may disappear at any time. The class [Base64](http://commons.apache.org/codec/apidocs/org/apache/commons/codec/binary/Base64.html) in [Apache Commons](http://commons.apache.org/codec/) should provide you with all the functionality you need. — Benjamin Muschko, Apr 12 '11 at 20:44
my question is how to properly decode a base64url string in java. and thanks i'll try apache commons — ufk, Apr 12 '11 at 20:47
@Benjamin, wow, I didn't realize `BASE64Decoder` was a Sun class, internal or otherwise. I wonder why they broke with their own naming convention. +1 — Pops, Apr 12 '11 at 20:49
@BenjaminMuschko Might be nice to clarify that is it specifically in [Apache Commons _Codec_](http://commons.apache.org/codec/) for those that don't realise it is a link in your comment! :) — Sled, Apr 16 '14 at 14:21

score 89 · Answer 1 · answered Jul 09 '16 at 22:54

89

Java8+

import java.util.Base64;


return Base64.getUrlEncoder().encodeToString(bytes);

answered Jul 09 '16 at 22:54

Boris Treukhov

17,493
9
70
91

40

If you don't like trailing '=' (padding), then use: Base64.getUrlEncoder().withoutPadding().encodeToString(str.g‌etBytes(UTF_8)) – jnr Dec 09 '16 at 19:10
1

@kiedysktos do you have an example sequence? Table `The "URL and Filename safe" Base 64 Alphabet` in does not allow `/` in [RFC 4648](https://tools.ietf.org/rfc/rfc4648.txt) which getUrlEncoder() uses – Boris Treukhov Dec 14 '17 at 11:14
1

EDIT: OK, I was using `getEncoder()` instead of `getUrlEncoder()`, my fault – kiedysktos Dec 14 '17 at 11:44

score 51 · Answer 2 · edited Oct 07 '21 at 07:34

51

Base64 encoding is part of the JDK since Java 8. URL safe encoding is also supported with java.util.Base64.getUrlEncoder(), and the "=" padding can be skipped by additionally using the java.util.Base64.Encoder.withoutPadding() method:

import java.nio.charset.StandardCharsets;
import java.util.Base64;

public String encode(String raw) {
    return Base64.getUrlEncoder()
            .withoutPadding()
            .encodeToString(raw.getBytes(StandardCharsets.UTF_8));
}

edited Oct 07 '21 at 07:34

Community

1
1

answered Mar 27 '15 at 09:29

deamon

89,107
111
320
448

The resulting string still contains equal signs. That's not URL safe, is it? – T3rm1 Oct 04 '16 at 11:29
8

Use Base64.getUrlEncoder().withoutPadding().encodeToString(str.getBytes(UTF_8)) – jnr Dec 09 '16 at 19:08

score 26 · Accepted Answer · edited Oct 08 '12 at 08:52

26

With the usage of Base64 from Apache Commons, who can be configured to URL safe, I created the following function:

import org.apache.commons.codec.binary.Base64;

public static String base64UrlDecode(String input) {
    String result = null;
    Base64 decoder = new Base64(true);
    byte[] decodedBytes = decoder.decode(input);
    result = new String(decodedBytes);
    return result;
}

The constructor Base64(true) makes the decoding URL-safe.

edited Oct 08 '12 at 08:52

Paolo Moretti

54,162
23
101
92

answered Apr 12 '11 at 21:23

ufk

30,912
70
235
386

1

idle curiosity, why make it that verbose if you could just do this? `return new String(new Base64(true).decode(input));` – Mithaldu Nov 27 '18 at 23:47

Oded Breiner · Answer 4 · 2016-03-05T12:19:28.097

7

In the Android SDK, there's a dedicated flag in the Base64 class: Base64.URL_SAFE, use it like so to decode to a String:

import android.util.Base64;
byte[] byteData = Base64.decode(body, Base64.URL_SAFE);
str = new String(byteData, "UTF-8");

edited Mar 05 '16 at 12:19

answered Mar 05 '16 at 11:17

Oded Breiner

28,523
10
105
71

score 6 · Answer 5 · edited Jun 22 '16 at 09:55

6

Guava now has Base64 decoding built in.

https://google.github.io/guava/releases/17.0/api/docs/com/google/common/io/BaseEncoding.html

edited Jun 22 '16 at 09:55

Community

1
1

answered Dec 17 '12 at 19:10

jontro

10,241
6
46
71

score 5 · Answer 6 · answered Mar 04 '12 at 22:55

public static byte[] encodeUrlSafe(byte[] data) {
    byte[] encode = Base64.encode(data);
    for (int i = 0; i < encode.length; i++) {
        if (encode[i] == '+') {
            encode[i] = '-';
        } else if (encode[i] == '/') {
            encode[i] = '_';
        }
    }
    return encode;
}

public static byte[] decodeUrlSafe(byte[] data) {
    byte[] encode = Arrays.copyOf(data, data.length);
    for (int i = 0; i < encode.length; i++) {
        if (encode[i] == '-') {
            encode[i] = '+';
        } else if (encode[i] == '_') {
            encode[i] = '/';
        }
    }
    return Base64.decode(encode);
}

Warning: Trailing = characters get swallowed! – pi. Jun 18 '15 at 14:10 — pi., Jun 18 '15 at 14:10

score 3 · Answer 7 · answered Apr 12 '11 at 20:39

3

Right off the bat, it looks like your replace() is backwards; that method replaces the occurrences of the first character with the second, not the other way around.

answered Apr 12 '11 at 20:39

Pops

30,199
37
136
151

score 2 · Answer 8 · answered Nov 04 '13 at 19:41

@ufk's answer works, but you don't actually need to set the urlSafe flag when you're just decoding.

urlSafe is only applied to encode operations. Decoding seamlessly handles both modes.

Also, there are some static helpers to make it shorter and more explicit:

import org.apache.commons.codec.binary.Base64;
import org.apache.commons.codec.binary.StringUtils;

public static String base64UrlDecode(String input) {
  StringUtils.newStringUtf8(Base64.decodeBase64(input));
}

Docs

score 1 · Answer 9 · answered Jan 24 '19 at 17:27

This class can help:

import android.util.Base64;

public class Encryptor {

    public static String encode(String input) {
        return Base64.encodeToString(input.getBytes(), Base64.URL_SAFE);
    }

    public static String decode(String encoded) {
        return new String(Base64.decode(encoded.getBytes(), Base64.URL_SAFE));
    }
}

score 1 · Answer 10 · answered Apr 17 '21 at 02:24

I know the answer is already there, but still, if someone wants...

import java.util.Base64; public 

class Base64BasicEncryptionExample {  

    publicstaticvoid main(String[] args) {  

       // Getting encoder  
       Base64.Encoder encoder = Base64.getUrlEncoder();  
       // Encoding URL  
       String eStr = encoder.encodeToString
                               ("http://www.javatpoint.com/javatutorial/".getBytes());  
       System.out.println("Encoded URL: "+eStr);  

       // Getting decoder  
       Base64.Decoder decoder = Base64.getUrlDecoder();  
       // Decoding URl  
       String dStr = new String(decoder.decode(eStr));  
       System.out.println("Decoded URL: "+dStr);  
    }  
}

Took help from: https://www.javatpoint.com/java-base64-encode-decode

score 0 · Answer 11 · answered Mar 22 '23 at 06:57

Base64.getUrlEncoder() already using -, _ instead of +, /.

See:

java-1.8.0/src.zip!/java/util/Base64.java

java.util.Base64

    /* Returns a Base64.Encoder that encodes using the URL and Filename safe type 
     * base64 encoding scheme.
     * Returns: A Base64 encoder.
     * */


    public static Encoder getUrlEncoder() {
         return Encoder.RFC4648_URLSAFE;
    }

...

    /*
     * It's the lookup table for "URL and Filename safe Base64" as specified in 
     * Table 2 of the RFC 4648, with the '+' and '/' changed to '-' and '_'. This 
     * table is used when BASE64_URL is specified.
     * */

    private static final char[] toBase64URL = {
        'A', 'B', 'C', 'D', 'E', 'F', 'G', 'H', 'I', 'J', 'K', 'L', 'M',
        'N', 'O', 'P', 'Q', 'R', 'S', 'T', 'U', 'V', 'W', 'X', 'Y', 'Z',
        'a', 'b', 'c', 'd', 'e', 'f', 'g', 'h', 'i', 'j', 'k', 'l', 'm',
        'n', 'o', 'p', 'q', 'r', 's', 't', 'u', 'v', 'w', 'x', 'y', 'z',
        '0', '1', '2', '3', '4', '5', '6', '7', '8', '9', '-', '_'
    };

...

    static final Encoder RFC4648_URLSAFE = new Encoder(true, null, -1, true);

Asokan · Answer 12 · 2016-01-04T15:28:24.177

-1

In Java try the method Base64.encodeBase64URLSafeString() from Commons Codec library for encoding.

edited Jan 04 '16 at 15:28

answered Nov 26 '15 at 14:39

Asokan

99
1
4

Decode base64Url in Java

12 Answers12

Linked

Related