btoa() Is Lying to You: Base64, Unicode, and the Mojibake in Your JWT
javascript
dev.to
A four-character name broke my base64 encoder last week. Not the network, not the token — the string café. Here is what I found after pulling the whole thing apart. 1. btoa() encodes bytes, and a JS string is not bytes btoa('café') // "Y2Fm6Q==" Looks right. Decode it somewhere that isn't JavaScript: >>> base64.b64decode('Y2Fm6Q==') b'caf\xe9' >>> base64.b64decode('Y2Fm6Q==').decode('utf-8') UnicodeDecodeError: 'utf-8' codec can't decode byte 0xe9 in position 3 ca