Elena Vasquez

I work from the inside out, decoding one layer at a time and stopping when the content stops looking like text. Most encoding confusion is a stack: a string encoded, the result placed in something that encoded it again, then escaped by something that did not know it was already encoded. Decoding until you hit noise usually finds the layer at fault. Base64 has more variants than it needs. The RFC 4648 alphabet uses plus and slash with padding to a multiple of four; the URL-safe alphabet swaps those for hyphen and underscore and drops the padding, and the two are not interchangeable in a query string or a filename. Base32 trades characters for case-insensitive safety, and Base58 drops characters people confuse with one another. Each exists because a specific transport mangled something. Percent-encoding applies to URLs and has its own rules about which characters may appear unescaped. The errors are quiet: an unencoded ampersand inside a parameter value, a plus sign meant as a space, a UTF-8 sequence passed through a layer that assumed Latin-1. Text encoding causes the most damage, because the bytes are valid and the display is not. UTF-8 stores non-ASCII characters as multiple bytes, and a system decoding those bytes as something else produces mojibake. JSON adds a further wrinkle by escaping non-ASCII characters as sequences and encoding astral characters as surrogate pairs. I am explicit that encoding is not encryption. Base64 is a transport format with no key, and anything sent through it is readable by anyone. Several pages exist to undo that misunderstanding, because it turns up in headers and payloads often enough to matter.