Why is base64_encode() adding a slash "/" in the result?

Question

I am encoding the URL suffix of my application:

$url = 'subjects?_d=1';
echo base64_encode($url);

// Outputs
c3ViamVjdHM/X2Q9MQ==

Notice the slash before 'X2'.

Why is this happening? I thought base64 only outputted A-Z, 0-9 and '=' as padding?

Because I am encoding a string to be used as a URL parameter, and the '/' breaks the application because it thinks it's the start of another parameter. — BadHorsie, Jul 12 '12 at 11:04
@BadHorsie — Use [`urlencode`](http://php.net/urlencode) to encode strings for URLs, not `base64_encode`. — Quentin, Jul 12 '12 at 12:29
yeah, slash was dumb. just about anything would have been better. — Erik Aronesty, Feb 01 '14 at 17:50

score 126 · Accepted Answer · edited Oct 07 '21 at 05:46

126

No. The Base64 alphabet includes A-Z, a-z, 0-9 and + and /.

You can replace them if you don't care about portability towards other applications.

See: http://en.wikipedia.org/wiki/Base64#Variants_summary_table

You can use something like these to use your own symbols instead (replace - and _ by anything you want, as long as it is not in the base64 base alphabet, of course!).

The following example converts the normal base64 to base64url as specified in RFC 4648:

function base64url_encode($s) {
    return str_replace(array('+', '/'), array('-', '_'), base64_encode($s));
}

function base64url_decode($s) {
    return base64_decode(str_replace(array('-', '_'), array('+', '/'), $s));
}

edited Oct 07 '21 at 05:46

Community

1
1

answered Jul 12 '12 at 10:11

Artefact2

7,516
3
30
38

Thanks. My app will always be PHP-based, so does it matter if I replace them? – BadHorsie Jul 12 '12 at 10:13
1

As long as you do the opposite transformation before decoding in your application, no. – Artefact2 Jul 12 '12 at 10:14
1

Not such a good idea to use a different scheme than the URL safe encoding as specified in [RFC 4648](http://tools.ietf.org/html/rfc4648#page-7) – Maarten Bodewes May 25 '14 at 13:05
This is an old question, but I second @owlstead's comment. Just use `urldecode()` and `urlencode()` on the base64 string. If you do this, you're straying away from the standards. – Spencer D Sep 22 '14 at 15:34
6

@SpencerGrantDoak RFC 4648 *does* specify a different alphabet for base64url that can be created by just replacing characters: `+` becomes `-`, `/` becomes `_`. This is more efficient than URL encoding, which may expand the result quite a lot for certain input (with a lot of bits set to 1). – Maarten Bodewes Sep 22 '14 at 16:45
@owlstead, thank you very much for letting me know about that. I knew that URL encoding was of course less memory efficient and tripled the message HTTP message size, but I was unaware that the RFC stated those replacing rules as an acceptable standard. Thank you for the information. – Spencer D Sep 22 '14 at 17:02
Not working for me, decode generates kind of garbage. – Volatil3 Nov 24 '15 at 08:57
Is there any reason + and / were chosen? – Shravya Boggarapu Feb 17 '20 at 13:52
What question are you answering with your "No." ? – gondo Jun 10 '20 at 07:14

score 26 · Answer 2 · edited Aug 19 '19 at 00:43

26

In addition to all of the answers above, pointing out that / is part of the expected base64 alphabet, it should be noted that the particular reason you saw a / in your encoded string, is because when base64 encoding ASCII text, the only way to generate a / is to have a question mark in a position divisible by three.

edited Aug 19 '19 at 00:43

Daniel Bejan

1,468
1
15
39

answered Apr 29 '16 at 15:00

Snorbuckle

1,176
1
10
8

1

What about `+`? If and only if `>` occurs in a position divisible by 3? – BeniBela Jan 27 '18 at 16:40
2

`~` will also produce a `+`. Not sure if there are others. – Josh Bernfeld Jan 05 '20 at 00:00

score 7 · Answer 3 · answered Jul 12 '12 at 10:11

7

Sorry, you thought wrong. A-Za-z0-9 only gets you 62 characters. Base64 uses two additional characters, in PHP's case / and +.

answered Jul 12 '12 at 10:11

deceze

510,633
85
743
889

score 5 · Answer 4 · answered Jul 12 '12 at 10:12

5

There is nothing special in that.

The base 64 "alphabet" or "digits" are A-Z,a-z,0-9 plus two extra characters + (plus) and / (slash).

You can later encode / with %2f if you want.

answered Jul 12 '12 at 10:12

Igor Chubin

61,765
13
122
144

score 5 · Answer 5 · answered Jul 12 '12 at 10:12

5

For base64 the valid charset is: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/

the = is used as filler for the last bytes

M.

answered Jul 12 '12 at 10:12

poussma

7,033
3
43
68

tfont · Answer 6 · 2017-04-30T13:45:44.703

5

Not directly related, and enough people above have answered and explained solutions quite well.

However, going a bit outside of the scope of things. If you want readable base text, try looking into Base58. It's worth considering if you want only alphanumeric characters.

edited Apr 30 '17 at 13:45

answered Apr 28 '17 at 13:08

tfont

10,891
7
56
52

score 3 · Answer 7 · answered Jul 12 '12 at 10:11

3

A-Z is 26 characters. 0-9 is 10 characters. = is one character. That gives a total of 37 characters, which is some way short of 64.

/ is one of the 64 characters. You can see a complete list on the wikipedia page.

answered Jul 12 '12 at 10:11

Quentin

914,110
126
1,211
1,335

don't forget the a-z too, bringing you to 63 characters :) – Paul Bain Jul 12 '12 at 10:13
1

@PaulBain — I didn't, the question did :) – Quentin Jul 12 '12 at 10:26

Why is base64_encode() adding a slash "/" in the result?

7 Answers7

Linked