data encoding ai_generated true

Base64 decoding fails with 'Invalid character' for URL-transmitted tokens or JWT segments

ID: data/base64-urlsafe-vs-standard-mismatch

Also available as: JSON · Markdown
88%Fix Rate
90%Confidence
3Evidence
2023-01-01First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
64 active — — —

Root Cause

Standard base64 uses +/ characters which are special in URLs. URL-safe base64 uses -_ instead. JWT uses URL-safe base64 WITHOUT padding (no = signs). Mixing these three variants causes silent corruption or decode errors.

generic

Workarounds

  1. 95% success Use base64.urlsafe_b64decode() with padding restoration for JWT 
    import base64; padded = segment + '=' * (-len(segment) % 4); base64.urlsafe_b64decode(padded)
  2. 92% success Use the correct base64 variant for each protocol 
    Standard (RFC 4648): +/ with =padding; URL-safe (RFC 4648 §5): -_ with =padding; JWT (RFC 7515): -_ WITHOUT padding
  3. 88% success Use PyJWT or similar library that handles base64url internally 
    import jwt; decoded = jwt.decode(token, key, algorithms=['HS256'])  # handles base64url internally

Dead Ends

Common approaches that don't work:

  1. Use standard base64.b64decode() to decode JWT segments 90% fail

    JWT uses URL-safe base64 WITHOUT padding. Standard b64decode fails on - and _ characters. Adding padding back is also needed.

  2. URL-encode standard base64 before putting in URL parameters 72% fail

    URL encoding turns + into %2B and / into %2F. The result is valid but 33% longer. URL-safe base64 is the correct solution.