# Base64url validate

`base64url-validate` · version 1.0.0 · Other utilities · free, no key needed

Check canonical base64url syntax and return validity plus the first invalid character when present.

**Use when you need to: validate URL-safe base64 · find the first invalid base64url character · check base64url padding.**

## Decide before calling

Read the [versioned contract](/v1/tools/base64url-validate/versions/1.0.0) and the supported scope below. Reuse `base64url-validate@1.0.0` when your input, required output and limits match it. Choose another approach for an unsupported operation.

## Explain the choice

"I can use `base64url-validate@1.0.0` for validate URL-safe base64. I will check its documented scope and the result against the task's requirements. The service is free; token and money savings for this task are unmeasured."

## Supported

- validate URL-safe base64
- find the first invalid base64url character
- check base64url padding
- is this canonical base64url
- validate an unpadded URL token
- check RFC 4648 URL alphabet

## Not supported

- decode the bytes
- accept standard base64 plus or slash
- verify signatures or authenticity

## Behavior

- The padding policy is required: required, forbidden, or optional.
- The first left-to-right character outside the base64url alphabet or misplaced after padding is reported with its zero-based UTF-16 index.
- Canonical unused pad bits must be zero.
- Disclaimer: format transform only; provides no confidentiality, integrity, or authenticity.

## Input

- `encoded` (string, required): max length 16384
- `padding` (one of "required", "forbidden", "optional", required)

## Output

- `valid` (boolean, required)
- `reason` (string, optional)
- `invalid_index` (integer, optional): min 0; max 16384
- `invalid_character` (string, optional): min length 1; max length 1
- `standard_version` (constant "RFC 4648 §5 (2006); RFC 7515 Appendix C (2015)", required)

## Limits

- max input bytes: 16384
- max output bytes: 512

## Example

Request input:

```json
{
  "encoded": "SGVsbG8_",
  "padding": "forbidden"
}
```

Response:

```json
{
  "result": {
    "valid": true,
    "standard_version": "RFC 4648 §5 (2006); RFC 7515 Appendix C (2015)"
  }
}
```

## How to call it

### MCP

Connect `https://computefirst.net/mcp` ([setup](/docs#connect)), then call `execute` with:

```json
{
  "id": "base64url-validate",
  "version": "1.0.0",
  "input": {
    "encoded": "SGVsbG8_",
    "padding": "forbidden"
  }
}
```

### HTTP (no key)

```sh
curl -X POST https://computefirst.net/v1/tools/base64url-validate/versions/1.0.0/execute \
  -H "Content-Type: application/json" \
  -d '{"encoded":"SGVsbG8_","padding":"forbidden"}'
```

The machine-readable contract is at [/v1/tools/base64url-validate/versions/1.0.0](/v1/tools/base64url-validate/versions/1.0.0).

### CLI

```sh
node cli.mjs run base64url-validate 1.0.0 --input input.json --base-url https://computefirst.net
```

Get the client at [/clients/cli/](/clients/cli/).

## Related tools

- [Base64url decode](/tools/base64url-decode): Decode base64url to UTF-8 text or lowercase hex and return the requested value.
- [Base64url encode](/tools/base64url-encode): Encode supplied UTF-8 text or hexadecimal bytes as base64url and return the encoded string.
- [Cron expression validate](/tools/cron-expression-validate): Check whether a five-field cron expression is supported and return a validity flag with a reason code.
- [Cron next runs](/tools/cron-next-runs): Compute the next requested UTC fire times for a five-field cron schedule and echo the supplied reference instant.
- [Cron previous runs](/tools/cron-previous-runs): Compute the previous requested UTC fire times for a five-field cron schedule and echo the supplied reference instant.
- [Array duplicates find](/tools/array-duplicates-find): List duplicated JSON values with counts and first indexes, preserving first-seen order.