← Back to list

Intro

Sometimes you encounter a base64 string but you don’t know the original text encoding. This guide shows a Python script that:

Saurabh suman · 2026-05-29 04:50 · 1 claps · 2.0 min read
#python #information-security #microsoft-defender #sigma #threat-hunting
Open on Medium ↗
Wiki topics: 💻 · Programming

Intro

Sometimes you encounter a base64 string but you don’t know the original text encoding. This guide shows a Python script that:

  • Sanitizes the base64 input,
  • Fixes missing padding,
  • Decodes the bytes,
  • Attempts to convert the bytes to text using several likely encodings.
import base64
# Put your base64 string here (can be multi-line)
base64_string = """<paste your base64 string here>"""
# Remove whitespace/newlines
base64_string = ''.join(base64_string.split())
# Fix missing padding (base64 strings length must be multiple of 4)
missing_padding = len(base64_string) % 4
if missing_padding:
    base64_string += '=' * (4 - missing_padding)
# Decode base64 to raw bytes
decoded_bytes = base64.b64decode(base64_string)
# Try a list of common encodings until one succeeds
encodings = ['utf-16le', 'utf-16', 'utf-8', 'latin-1']
for encoding in encodings:
    try:
        decoded_string = decoded_bytes.decode(encoding, errors='ignore')
        print(f"Successfully decoded with {encoding}:\n")
        print(decoded_string)
        break
    except Exception as e:
        print(f"Failed with {encoding}: {e}")

Explanation

import base64

  • Imports Python’s standard library for base64 encoding/decoding.

base64_string = “””…”””

  • Place your base64 string here. Using triple quotes lets you paste multi-line strings directly.

base64_string = ‘’.join(base64_string.split())

  • Remove whitespace and newlines that might have been introduced by copy/paste or line-wrapping.

missing_padding = len(base64_string) % 4

  • Base64 encodes data in 4-character blocks. If the length isn’t a multiple of 4, padding using ‘=’ is required.

if missing_padding: base64_string += ‘=’ * (4 — missing_padding)

  • Append the correct number of ‘=’ characters to restore valid padding.

decoded_bytes = base64.b64decode(base64_string)

  • Convert base64 to raw bytes. This can raise an exception if the string is invalid.

encodings = [‘utf-16le’, ‘utf-16’, ‘utf-8’, ‘latin-1’]

  • A small prioritized list of encodings to try. Order is chosen because many Windows/UTF-16 variants appear in such cases; adjust as needed.

decoded_bytes.decode(encoding, errors=’ignore’)

  • Attempt to decode bytes to text. errors=’ignore’ will drop invalid byte sequences rather than raising; you can use errors=’replace’ to get placeholders for invalid bytes.
  • The loop stops when one encoding yields text; otherwise you’ll see failure messages for each tried encoding.

Why the encoding list and order?

  • utf-16le / utf-16: Byte-order-marked or little-endian UTF-16 is common for Windows-generated text or some exports.
  • utf-8: The most common modern text encoding.
  • latin-1: Single-byte mapping that will always succeed (no decode errors) and preserves raw byte values 0–255 — useful as a last resort if you want to inspect raw characters.

Safety and caveats

  • errors=’ignore’ hides decoding problems; if you want to spot issues, use errors=’strict’ (raises exceptions) or errors=’replace’
  • base64 input might represent binary files (images, executables). Don’t assume textual content — inspect the bytes (e.g., check magic/header bytes) before treating them as text.
  • Avoid decoding untrusted data in insecure environments. If the decoded content is saved and executed, it could be harmful.

Optimise my code

  • Auto-detect encoding with chardet or charset-normalizer:

pip install charset-normalizer

  • Use charset_normalizer from_bytes(decoded_bytes).best() to suggest encodings.
  • Save bytes to a file if the content might be binary:

with open(‘output.bin’, ‘wb’) as f: f.write(decoded_bytes)

  • Print a small bytes hex preview to inspect binary signatures:

print(decoded_bytes[:32].hex())

Example: using charset-normalizer (small snippet)

from charset_normalizer import from_bytes
result = from_bytes(decoded_bytes).best()
if result:
    print("Detected encoding:", result.encoding)
    print(result.first().decoded)

How to run

  • Save the script to decode_base64.py and run: python decode_base64.py (Python 3.8+ recommended).

메타데이터
post_id
0f0128dfce35
slug
intro-0f0128dfce35
url
https://medium.com/@saurabhsumangate/intro-0f0128dfce35
canonical_url
https://medium.com/@saurabhsumangate/intro-0f0128dfce35
author_url
https://medium.com/@saurabhsumangate
status
ok
fetched_at
2026-07-10 09:05:01