I am using the base64_decode() and base64_encode() in my code but PHPCS says

The use of function base64_decode() is discouraged so what's the equivalence of this core PHP function in Magento2?

  • There is literally no wrapper class for this function, closest you can go is \Magento\Framework\Serialize\Serializer\Serialize which json decode and base_64decode the string simultaneously, classic case of Magento being Magento. Commented Aug 4, 2020 at 7:24

4 Answers 4


Magento does not have equivalence function of base64_decode() and base64_encode() method.

Using phpcs:ignore you can use these two methods.Like Below

// phpcs:ignore Magento2.Functions.DiscouragedFunction
// phpcs:ignore Magento2.Security.LanguageConstruct.ExitUsage
  • Thanks Amit, does magento marketplace accept this code in extension?
    – Max
    Commented Jul 14, 2020 at 11:25
  • yes, they will accept the extension so far my understanding.
    – Amit Bera
    Commented Jul 14, 2020 at 11:35
  • Sir, please look on this issue : magento.stackexchange.com/questions/317446/… Commented Jul 20, 2020 at 13:43
  • As seen in /vendor/magento files, we only need the first ignore // phpcs:ignore Magento2.Functions.DiscouragedFunction base64_decode($content); . <br /> The second ignore // phpcs:ignore Magento2.Security.LanguageConstruct.ExitUsage Is used when the PHP command "exit" is used
    – brjupo
    Commented Nov 14, 2023 at 20:50

Both the method have different Interface.

Magento\Framework\Url\EncoderInterface.php used for encode URL.

Magento\Framework\Url\DecoderInterface.php used for decode URL.

public function __construct(
    \Magento\Framework\Url\EncoderInterface $urlEncoder,
    \Magento\Framework\Url\DecoderInterface $urlDecoder
) {
    $this->urlEncoder = $urlEncoder;
    $this->urlDecoder = $urlDecoder;

public function execute()


Answer about EncoderInterface and DecoderInterface is good but I wasn't happy having this as two separated properties to use.

Doing a little bit more digging I found out that Magento\Framework\Url\Decoder is setting the URL result to urlBuilder as sessionUrlVar which is not always intended and I definitely wasn't happy about.

I was looking for something I can pass safely as URL param for secure file download (verification permission to the file etc) so I wanted to encode file ID and customer ID in the URL param. I also wanted the function not to affect any other URL building or anything else so I found this class:


Usage is same as with any other encryptor, which in my case looked like (input/output is flat array with named keys):



namespace Vendor\MyModule\Service\Encoder;

use Magento\Framework\Encryption\UrlCoder;
use Magento\Framework\Serialize\Serializer\Json;

class FileDownloadUrlParam

    public function __construct(
        private readonly Json $jsonSerializer,
        private readonly UrlCoder $urlCoder
    ) {

    public function encode(array $attributes): string
        return $this->urlCoder->encode(

    public function decode(string $param): array
        return $this->jsonSerializer->unserialize(

As this is PHP 8.1, it's like this, for PHP 8.2 project I would make whole class as readonly instead of it's properties. I stripped the code above by any documentation comments to keep it shorter but any IDE should autogenerate it from function definitions. Also I rely on throwing exception from any of the used encoders and serializers, to be passed to the caller, so exception handler should be IMHO elsewhere - hence it's not here.

Also if someone tries to decode it, it's totally fine as there will be just two IDs which wouldn't tell anything.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.