Base64url validate

base64url-validate · version 1.0.0 · Other utilities · free, no key needed

Check canonical base64url syntax and return validity plus the first invalid character when present.

Use when you need to: validate URL-safe base64 · find the first invalid base64url character · check base64url padding.

Decide before calling

Read the versioned contract and the supported scope below. Reuse base64url-validate@1.0.0 when your input, required output and limits match it. Choose another approach for an unsupported operation.

Explain the choice

"I can use base64url-validate@1.0.0 for validate URL-safe base64. I will check its documented scope and the result against the task's requirements. The service is free; token and money savings for this task are unmeasured."

Supported

• validate URL-safe base64
• find the first invalid base64url character
• check base64url padding
• is this canonical base64url
• validate an unpadded URL token
• check RFC 4648 URL alphabet

Not supported

• decode the bytes
• accept standard base64 plus or slash
• verify signatures or authenticity

Behavior

• The padding policy is required: required, forbidden, or optional.
• The first left-to-right character outside the base64url alphabet or misplaced after padding is reported with its zero-based UTF-16 index.
• Canonical unused pad bits must be zero.
• Disclaimer: format transform only; provides no confidentiality, integrity, or authenticity.

Input

• encoded (string, required): max length 16384
• padding (one of "required", "forbidden", "optional", required)

Output

• valid (boolean, required)
• reason (string, optional)
• invalid_index (integer, optional): min 0; max 16384
• invalid_character (string, optional): min length 1; max length 1
• standard_version (constant "RFC 4648 §5 (2006); RFC 7515 Appendix C (2015)", required)

Limits

• max input bytes: 16384
• max output bytes: 512

Example

Request input:

{
  "encoded": "SGVsbG8_",
  "padding": "forbidden"
}

Response:

{
  "result": {
    "valid": true,
    "standard_version": "RFC 4648 §5 (2006); RFC 7515 Appendix C (2015)"
  }
}

How to call it

MCP

Connect https://computefirst.net/mcp (setup), then call execute with:

{
  "id": "base64url-validate",
  "version": "1.0.0",
  "input": {
    "encoded": "SGVsbG8_",
    "padding": "forbidden"
  }
}

HTTP (no key)

curl -X POST https://computefirst.net/v1/tools/base64url-validate/versions/1.0.0/execute \
  -H "Content-Type: application/json" \
  -d '{"encoded":"SGVsbG8_","padding":"forbidden"}'

The machine-readable contract is at /v1/tools/base64url-validate/versions/1.0.0.

CLI

node cli.mjs run base64url-validate 1.0.0 --input input.json --base-url https://computefirst.net

Get the client at /clients/cli/.

Related tools

• Base64url decode: Decode base64url to UTF-8 text or lowercase hex and return the requested value.
• Base64url encode: Encode supplied UTF-8 text or hexadecimal bytes as base64url and return the encoded string.
• Cron expression validate: Check whether a five-field cron expression is supported and return a validity flag with a reason code.
• Cron next runs: Compute the next requested UTC fire times for a five-field cron schedule and echo the supplied reference instant.
• Cron previous runs: Compute the previous requested UTC fire times for a five-field cron schedule and echo the supplied reference instant.
• Array duplicates find: List duplicated JSON values with counts and first indexes, preserving first-seen order.