---
title: "Codecs — Crypto for Laravel | Roundly"
description: "Strict base64url, padded base64, base32 and hex — canonical-only decoding that rejects malformed input instead of mangling it."
url: https://roundly-consulting.com/open-source/docs/crypto-for-laravel/codecs
language: en
---

[All packages](https://roundly-consulting.com/open-source.md)

[Crypto for Laravel](https://roundly-consulting.com/open-source/docs/crypto-for-laravel.md)

# Codecs

Four static codecs, each with encode() and decode(). Encoding is total; decoding is deliberately strict and throws Codec\\InvalidEncodingException on malformed or non-canonical input, so a tampered value never silently decodes into different bytes:

```php
use RoundlyConsulting\Crypto\Facades\Crypto;

$encoded = Crypto::base64UrlEncode($bytes);      // unpadded, URL-safe
$bytes   = Crypto::base64UrlDecode($encoded);    // STRICT — throws InvalidEncodingException

Crypto::base64Encode($bytes);   Crypto::base64Decode($padded);
Crypto::base32Encode($bytes);   Crypto::base32Decode($secret);
Crypto::hexEncode($bytes);      Crypto::hexDecode($hex);
```

Or call the classes the facade fronts directly:

```php
use RoundlyConsulting\Crypto\Codec\Base64Url;
use RoundlyConsulting\Crypto\Codec\Base64;
use RoundlyConsulting\Crypto\Codec\Base32;
use RoundlyConsulting\Crypto\Codec\Hex;

$encoded = Base64Url::encode($bytes);        // unpadded, URL-safe
$bytes   = Base64Url::decode($encoded);      // STRICT: rejects +, /, =, and non-alphabet

$padded  = Base64::encode($bytes);           // standard padded base64 (+/ alphabet, = padding)
$bytes   = Base64::decode($padded);          // STRICT: rejects non-canonical / non-alphabet

$secret  = Base32::encode($randomBytes);     // e.g. "GEZDGNBVGY3TQOJQ"
$bytes   = Base32::decode($secret);          // case-insensitive; canonical, strict

$hex     = Hex::encode($bytes);              // lower-case, e.g. "68656c6c6f"
$bytes   = Hex::decode($hex);                // throws on odd length or any non-hex character
```

| Class | Form | Decoding rejects |
| --- | --- | --- |
| `Base64Url` | Unpadded URL-safe alphabet (RFC 4648 §5). | +, /, =, any non-alphabet byte, empty input and a dangling single character. |
| `Base64` | Standard alphabet with = padding (RFC 4648 §4). | Non-alphabet bytes, wrong or missing padding, whitespace, non-canonical encodings and empty input. |
| `Base32` | A–Z2–7, unpadded on encode (RFC 4648). | Case-insensitive, but rejects non-alphabet characters (including whitespace), interior =, dangling characters and non-zero trailing bits. |
| `Hex` | Lower-case hexadecimal. | Odd length and any non-hex character. |

## Handling bad input

```php
use RoundlyConsulting\Crypto\Codec\InvalidEncodingException;

try {
    $bytes = Base64Url::decode($userInput);
} catch (InvalidEncodingException $e) {
    // reject the tampered / malformed value
}
```

Every encode() / decode() input is #\[\\SensitiveParameter\]: OTP secrets, token bytes and keys pass through these codecs, so a value that fails to decode never shows up in the exception’s stack trace.

Both base64 codecs encode '' as '' but refuse to decode it: every field they carry — a JWS segment, a signature header, a key — is non-empty when valid, so an empty value is treated as missing, never as zero bytes. Base32::decode('') returns '' (an empty OTP secret is refused one layer up, by Hotp). Base32 does not strip whitespace — trim input first if a source adds newlines. Base32::ALPHABET is exposed as a public constant, and every codec is also reachable through the Crypto facade.

## Show your open-source love

This package is free and MIT-licensed. If it saves you time, a one-off donation or a Patreon membership keeps it maintained, tested and documented.

[More ways to support, including crypto](https://roundly-consulting.com/support-us.md)

By donating, you agree to our [donation terms](https://roundly-consulting.com/donation-terms.md).

[Support our open source work (opens in a new tab)](https://donate.stripe.com/dRmeVe8FX5PF1Qd9pXcEw00) [Join us on Patreon (opens in a new tab)](https://www.patreon.com/cw/roundly)

## Want this built into your product?

We integrate our packages into custom Laravel and AI builds. Tell us what you're working on and we'll reply within 48 hours.

[Get a quote in 48 hours](https://roundly-consulting.com/contact.md) [Browse all packages](https://roundly-consulting.com/open-source/docs/crypto-for-laravel.md)