Reading — step 1 of 5
Read
~1 min readDecoding
Decode Errors
Invalid base64 inputs should be rejected:
| Error | Example |
|---|---|
| Length not %4 == 0 | SGVsbG8 |
| Invalid char | SGVs@G8= |
= mid-string | SG=lbG8= |
Too many = | SGVs=== |
| Length %4 == 1 | SGVsbG8a (impossible — would imply 0.75 input bytes) |
Strict decoders reject all of these. Lenient ones ignore some (e.g. whitespace, unknown chars, unpadded input).
Python's base64.b64decode is lenient by default; pass validate=True for strict mode.
Common bug: forgetting that = is structural padding, not data. b64decode("a===") raises but b64decode("a===", validate=False) may succeed in some libraries — implementation-defined.
For SECURITY-sensitive uses (parsing JWT, certificate signatures), use STRICT decoders. Lenient decoders can let attackers smuggle ambiguous data.
Discussion
Ask a question, share an insight, or help someone who’s stuck.
Sign in to post a comment or reply.
Loading…