Why does the same cleaned text have different Base64 and Base64url strings?

Measured inputs and outputs

These are locally constructed test strings, not evidence that Claude inserts these characters. We executed the saved homepage script snapshot with a minimal DOM harness and compared exact strings. The invisible-checkbox state and dash mode appear in each row. The observations below test this page's specific question. Destination observations run independently on the exact input and cleaned strings in the recorded Node runtime. We make no detector-score or statistical-watermark removal claim.

The encoded spellings differ while decoded bytes agree

For each supplied string, the observer first creates a UTF-8 Buffer and then serializes that same buffer using base64 and base64url. The cleaned emoji control has byte hex f09f9880. Its standard spelling is 8J+YgA== while its URL-oriented spelling is 8J-YgA. Decoding the latter with base64url reproduces f09f9880 exactly. The marked emoji fixture contains additional bytes for U+200B before cleanup; those bytes disappear only when the actual input marker is removed. The alphabet and padding difference remains afterwards. Our record keeps byte hex, both encoded strings and decoded hex together rather than comparing only character counts or visual similarity.

The accent and ASCII controls isolate padding differences

For the accent é, the strings are w6k= and w6k; for ASCII AB they are QUI= and QUI. These controls do not require a plus-to-hyphen substitution, yet still show unequal encoded spellings because padding differs. The observer does not edit the encoded strings with a replacement expression; it asks the recorded Node runtime to produce each form. The earlier Base64 payload guide starts with an encoded wrapper and inspects its decoded hidden content. Today the source is already decoded text, and the question concerns selecting an output encoding for the same known bytes. We do not test malformed payload acceptance, every decoder implementation or a server-specific token format.

Follow the destination encoding contract when exporting

Choose the encoding name required by the receiving format and verify its expected alphabet and padding rules. A different spelling need not mean different decoded content, so compare the decoded bytes where the format permits that check. Conversely, matching decoded bytes does not establish a signature’s validity or authorize rewriting signed material. No signature, authentication protocol, encrypted blob or remote endpoint is involved in these fixtures. The cleaned emoji is simply a short authored string. Preserve its raw text and versioned byte record when investigating an export discrepancy. The original downloads show precisely which bytes changed during cleanup and which representational differences were introduced later by the two encoder choices.

Reproduce this test

Save reproduce.cjs and tested-app.js in the same folder. Run the command below with Node.js. The harness prints its runtime, script SHA-256 and every measured row. Compare those rows with the original record. Using a newer script or runtime creates a new experiment; retain the version information with your rerun.

node reproduce.cjs