A field guide to the URL-safe Base64 variant that powers JWT, JWS, and JWE — the three-character substitution that lets tokens survive URL parsing, the four operations in the encoder, the four edge cases that catch first-time auditors, and a six-tool companion pipeline for JWT debugging.