# URL-Safe Base64 Token Key: `technology.cryptographic.token_urlsafe` Random token encoded in URL-safe Base64 (uses - and \_ instead of + and /). Commonly used for auth tokens, reset links, and secure identifiers. Page: Samples: `SFMyNDI5STExOjEwMQ`, `dGVzdC10b2tlbg`, `aGVsbG8td29ybGQ` ## Background ### Origin RFC 4648 notes that the pad character = is typically percent-encoded when used in a URI, and that padding can be skipped if the data length is known implicitly.[[1]](https://www.rfc-editor.org/rfc/rfc4648) RFC 7515, JSON Web Signature (JWS), defines Base64url Encoding as the RFC 4648 URL-safe alphabet with all trailing = characters omitted.[[2]](https://www.rfc-editor.org/rfc/rfc7515) ### Use Python's secrets.token\_urlsafe returns a random URL-safe text string containing a given number of random bytes, Base64 encoded.[[3]](https://docs.python.org/3/library/secrets.html) The Python documentation says each random byte becomes approximately 1.3 characters on average in a token\_urlsafe string.[[3]](https://docs.python.org/3/library/secrets.html) The illustrative implementation in PEP 506 strips the trailing = padding from the URL-safe Base64 output.[[4]](https://peps.python.org/pep-0506/) Node.js's base64url Buffer encoding follows RFC 4648 Section 5 and omits padding when encoding a Buffer to a string.[[5]](https://nodejs.org/api/buffer.html) A column of reset tokens or session identifiers is sensitive, so it is worth masking or dropping before a file is shared. (Meridian's view) ## Sources 1. [RFC 4648: The Base16, Base32, and Base64 Data Encodings](https://www.rfc-editor.org/rfc/rfc4648) — standard 2. [RFC 7515: JSON Web Signature (JWS)](https://www.rfc-editor.org/rfc/rfc7515) — standard 3. [secrets — Generate secure random numbers for managing secrets](https://docs.python.org/3/library/secrets.html) — documentation 4. [PEP 506 – Adding A Secrets Module To The Standard Library](https://peps.python.org/pep-0506/) — documentation 5. [Buffer](https://nodejs.org/api/buffer.html) — documentation