recommendation is url safe base64