Step 1 of 5 · Reading · ~1 min
Read
Decoding
Decode Errors
Invalid base64 inputs should be rejected:
| Error | Example |
|---|---|
| Length not %4 == 0 | SGVsbG8 (7 chars) |
| Invalid char | SGVs@G8= |
= mid-string | SG=lbG8= |
Too many = | SGVs=== |
| Leftover of 1 char | SGVsbG8gV (9 chars) — one character is 6 bits, not enough for a byte |
Strict decoders reject all of these. Lenient ones ignore some (e.g. whitespace, unknown chars, unpadded input).
Python's base64.b64decode is lenient by default; pass validate=True for strict mode.
Common bug: forgetting that = is structural padding, not data. b64decode("a===") raises but b64decode("a===", validate=False) may succeed in some libraries — implementation-defined.
For SECURITY-sensitive uses (parsing JWT, certificate signatures), use STRICT decoders. Lenient decoders can let attackers smuggle ambiguous data.
Up nextBase64URLVariants
Discussion
Ask a question, share an insight, or help someone who’s stuck.
Sign in to post a comment or reply.
Loading…