You can spot base64 encoded JSON, certificates, and private keys

Last modified August 5, 2025

I was working on my homelab and examined a file that was supposed to contain encrypted content that I could safely commit on a Github repository. The file looked like this

{  "serial": 13,  "lineage": "24d431ee-3da9-4407-b649-b0d2c0ca2d67",  "meta": {    "key_provider.pbkdf2.password_key": "eyJzYWx0IjoianpHUlpMVkFOZUZKcEpSeGo4UlhnNDhGZk9vQisrR0YvSG9ubTZzSUY5WT0iLCJpdGVyYXRpb25zIjo2MDAwMDAsImhhc2hfZnVuY3Rpb24iOiJzaGE1MTIiLCJrZXlfbGVuZ3RoIjozMn0="  },  "encrypted_data": "ONXZsJhz37eJA[...]",  "encryption_version": "v0"}

Hm, key provider? Password key? In an encrypted file? That doesn’t sound right. The problem is that this file is generated by taking a password, deriving a key from it, and encrypting the content with that key. I don’t know what the derived key could look like, but it could be that long indecipherable string.

I asked a colleague to have a look and he said “Oh that? It looks like a base64 encoded JSON. Give it a go to see what’s inside.”

I was incredulous but gave it a go, and it worked!!

$ echo "eyJzYW[...]" | base64 -d{"salt":"jzGRZLVANeFJpJRxj8RXg48FfOoB++GF/Honm6sIF9Y=","iterations":600000,"hash_function":"sha512","key_length":32}

I couldn’t believe my colleague had decoded the base64 string on the fly, so I asked. “What gave it away? Was it the trailing equal signs at the end for padding? But how did you know it was base64 encoded JSON and not just a base64 string?”

He replied,

Whenever you see ey, that’s {" and then if it’s followed by a letter, you’ll get J followed by a letter.

I did a few tests in my terminal, and he was right! You can spot base64 json with your naked eye, and you don’t need to decode it on the fly!

$ echo "{" | base64ewo=$ echo "{\"" | base64eyIK$ echo "{\"s" | base64eyJzCg==$ echo "{\"a" | base64eyJhCg==$ echo "{\"word\"" | base64eyJ3b3JkIgo=

But there’s even better! As tyzbit reported on the fediverse, you can even spot base64 encoded certificates and private keys! They all start with LS, which reminds of the LS in “TLS certificate.”

$ echo -en "-----BEGIN CERTIFICATE-----" | base64LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0t

Errata

As pointed out by gnabgib and athorax on Hacker News, this actually detects the leading dashes of the PEM format, commonly used for certificates, and a YAML file that starts with --- will yield the same result

$ echo "---\n" | base64LS0tXG4K

This is not a silver bullet!

Thanks Davide and Denis for showing me this simple but pretty useful trick, and thanks tyzbit for completing it with certs and private keys!