Base64 Padding
Explains what trailing = and == mean in Base64. Check padding status and fix with one click.
What is Base64 Padding?
Base64 processes 3 bytes at a time, producing 4 characters. If the input length is not a multiple of 3, the last group has fewer than 3 bytes — = padding is appended to make the output length always a multiple of 4.
The = character carries no data — it is a placeholder that tells the decoder "no real data here".
Where does = come from?
The result of input bytes mod 3 determines how many = characters to add:
| Input | Bytes | mod 3 | Base64 output | Padding |
|---|---|---|---|---|
| "Man" | 3 | 0 | TWFu | (no padding needed) |
| "Ma" | 2 | 2 | TWE= | add 1 × = |
| "M" | 1 | 1 | TQ== | add 2 × == |
Rule: input bytes mod 3 = 0 → no padding; = 1 → add 2 × ==; = 2 → add 1 × =.
Is padding required?
It depends on the context.
Padding required
- RFC 4648 standard Base64
- Data URLs in HTML / CSS
- MIME email attachments
- Strict decoders (e.g. Python's base64.b64decode)
Padding not required
- Base64URL (URL params, query strings)
- JWT tokens (Header.Payload.Signature)
- Most modern decoders handle unpadded input
- = is a reserved character in URLs and needs escaping
Standard Base64 vs Base64URL
| Aspect | Standard Base64 | Base64URL |
|---|---|---|
| Char 62 | + | - (URL-safe) |
| Char 63 | / | _ (URL-safe) |
| Padding | = or == (required) | omitted (optional) |
| Typical use | Data URL, email, files | JWT, URL params, Web API |
| RFC | RFC 4648 §4 | RFC 4648 §5 |
How to fix padding in code
// add padding const pad = str => str + '='.repeat((4 - str.length % 4) % 4) // remove padding const unpad = str => str.replace(/=+$/, '') // Base64URL → standard Base64 (with padding) const fromBase64Url = str => pad(str.replace(/-/g, '+').replace(/_/g, '/'))
import base64
# add padding and decode (Python requires padding)
def decode(s):
s += '=' * ((4 - len(s) % 4) % 4)
return base64.b64decode(s)import "encoding/base64" // Go provides four decoders base64.StdEncoding.DecodeString(padded) // requires padding base64.RawStdEncoding.DecodeString(s) // no padding base64.URLEncoding.DecodeString(urlB64) // URL-safe + padding base64.RawURLEncoding.DecodeString(s) // URL-safe, no padding
Related Tools
Base64 Validator
Check whether a Base64 string is valid, detect its type, MIME, byte count, and error position.
Base64 Cleaner
Strip quotes, newlines, JSON escapes, and Data URL prefixes to get clean Base64.
Base64URL Encoder
Encode and decode URL-safe Base64URL for JWT and Web APIs.
JWT Decoder
Decode a JWT Header and Payload to view claims and expiry.
Base64 to Text
Decode a Base64 string to UTF-8 or ASCII text.
Base64 to JSON
Decode Base64 to JSON and format it — supports JWT payloads.
Frequently Asked Questions
What does = mean at the end of a Base64 string?
= is Base64 padding. Base64 processes 3 bytes at a time, outputting 4 characters. When the input byte count is not a multiple of 3, = is appended to make the output length a multiple of 4. = itself carries no data — it is just a placeholder.
Why is it sometimes = and sometimes ==?
It depends on input bytes mod 3: remainder 1 → add 2 × ==; remainder 2 → add 1 × =; remainder 0 → no padding. For example "M" is 1 byte (mod 3 = 1), encoded as TQ==; "Ma" is 2 bytes (mod 3 = 2), encoded as TWE=.
Does removing = affect Base64 usage?
Some decoders (e.g. Python's base64.b64decode) strictly require padding and will error without it. Most modern decoders handle unpadded input automatically. Base64URL (RFC 4648 §5) explicitly does not require padding.
Why doesn't JWT include =?
JWT uses the Base64URL variant, which replaces + and / with - and _ and omits padding. The reason: = is a reserved character in URLs (used in query strings), so including it directly in a URL requires percent-encoding — omitting it is simpler.
How do I restore missing padding in JavaScript?
Use this expression: str + '='.repeat((4 - str.length % 4) % 4). When the length is already a multiple of 4, (4 - 0) % 4 = 0, so no = is added; remainder 2 adds 2; remainder 3 adds 1.
Why does Go's base64 package have four decoders?
Go provides StdEncoding (standard + padding), RawStdEncoding (standard, no padding), URLEncoding (URL-safe + padding), and RawURLEncoding (URL-safe, no padding) — covering all Base64 variants. Choose the decoder that matches the encoder.