Base64 Padding: Equal Signs and Canonical Output
Base64 padding places trailing = characters after the encoded payload to complete a group. For the one-byte value below, the canonical padded text is Zg==. Matching == endings do not guarantee matching canonical text: decode the bytes, re-encode them, and compare the strings.
Three padded inputs, one decoded byte
The Python 3.12.14 run on 2026-10-24 decoded Zg== with base64.b64decode(value, validate=True) and returned hexadecimal 66. Passing those returned bytes to base64.b64encode() produced Zg==.
Under the same decoding call, Zh== also returned hexadecimal 66. Re-encoding the returned bytes produced Zg==, not Zh==.
Input Zv== returned hexadecimal 66 in that run as well. Re-encoding produced Zg== rather than Zv==.
| Input | Decoded hex | Re-encoded text | Exact text match |
|---|---|---|---|
Zg== | 66 | Zg== | yes |
Zh== | 66 | Zg== | no |
Zi== | 66 | Zg== | no |
Zj== | 66 | Zg== | no |
Zk== | 66 | Zg== | no |
Zl== | 66 | Zg== | no |
Zm== | 66 | Zg== | no |
Zn== | 66 | Zg== | no |
Zo== | 66 | Zg== | no |
Zp== | 66 | Zg== | no |
Zq== | 66 | Zg== | no |
Zr== | 66 | Zg== | no |
Zs== | 66 | Zg== | no |
Zt== | 66 | Zg== | no |
Zu== | 66 | Zg== | no |
Zv== | 66 | Zg== | no |
Strict decoding of missing and extra padding
In a separate Python 3.12.14 run on 2026-10-24, decoding the two-byte ASCII input Zg with validate=True raised binascii.Error with the message Incorrect padding. Decoding the three-byte ASCII input Zg= with the same call raised binascii.Error with the message Incorrect padding. Decoding the five-byte ASCII input Zg=== with validate=True raised binascii.Error with the message Excess data after padding. Decoding Zg== followed by one newline, a five-byte input, raised binascii.Error with the message Excess data after padding. Decoding the eight-byte ASCII input Zg==AAAA with validate=True raised binascii.Error with the message Excess data after padding. Decoding the four-byte ASCII control input Zg== returned one byte with hexadecimal 66, and re-encoding that byte returned Zg==.
Keep padding checks separate from canonical checks
The recorded behavior belongs to this Python version and these inputs; it is not a promise that every decoder accepts the variants. Where a protocol requires canonical Base64, checking only alphabet validity and trailing equal signs is insufficient. Compare a standard re-encoding of the recovered bytes with the original standard padded input. Do not apply that comparison unchanged to an explicitly unpadded Base64url protocol. Use the Base64 decoder for general byte inspection.