flashman
← All posts

Base64 padding and URL-safe debugging

Debug Base64 that still decodes: missing padding and whitespace are accepted, the URL-safe minus sign is rejected, and a blank box prints nothing at all.

2026-10-21 · 5 min read · Rahul Chitturi

  • base64
  • encoding
  • debugging

The Base64 page encodes and decodes UTF-8 with the standard alphabet. A box that trims to nothing returns an empty string in either mode, so a paste of only spaces is not the encoding of those spaces and not an error. A box that contains real text, including leading spaces, is passed through unchanged.

Decode uses atob. That decoder accepts standard Base64 with or without padding, and it skips ASCII whitespace. It rejects the URL-safe characters - and _.

Encode the bytes you can see

flashman encodes to Zmxhc2htYW4=. A single é encodes to w6k=. The emoji 🙂 encodes to 8J+Zgg==. a followed by a newline and b encodes to YQpi. a followed by CRLF and b encodes to YQ0K. The two-space string, space a space, encodes to IGEg. Those spaces are data.

Encode does not wrap lines and does not switch to the URL-safe alphabet. + and / can appear. = appears when the byte length needs padding. Copy copies the output, including an Error: line when encode somehow throws.

  • Count spaces before you encode.
  • Expect é to occupy two UTF-8 bytes.
  • Expect a newline and a CRLF to encode differently.
  • Keep + and / when the next hop is standard Base64.

Decode what atob actually accepts

Zmxhc2htYW4= and Zmxhc2htYW4 both decode to flashman. YQ and YQ== both decode to a. A newline or a trailing space inside the token is skipped, so YQ== followed by a newline is still a, and Zmxh then a newline then Y2g= is flach. Zm xh, with a space, is fla.

ab-c throws Error: Invalid character because of the minus sign. * , !!!!, and a pasted é do the same. ab+c is accepted as standard Base64 and then decoded as UTF-8, which may show a replacement character when the bytes are not text. abc= is the same kind of result: the alphabet was valid, and the bytes were not a character you can read. The page does not turn that into an error.

Separate this box from a JWT segment

A JWT segment is base64url. It uses - and _, and it omits padding. This page will decode it only after you restore + and /. The JWT page already does that conversion for header and payload. Pasting the segment here without that conversion stops on the first minus or underscore.

Use the Base64 tool for the standard alphabet, the JWT tool for a token, and the hash tool when you need a hex digest of the original text. A hash of the Base64 string is a different digest from a hash of the decoded text.

Try these tools