diff --git a/src/base64.c b/src/base64.c
index 52247fc6..cc3f01de 100644
--- a/src/base64.c
+++ b/src/base64.c
@@ -34,9 +34,15 @@
 #include "base64.h"
 
 /* ---------------- private code */
+/*
+ * Decoding table indexed by (c - 43). It accepts both the standard alphabet
+ * ('+' and '/') and the URL-safe one ('-' and '_'), since keys are quoted
+ * from tools using either: `openssl rand -base64` emits standard base64,
+ * while shadowsocks configs have traditionally used the URL-safe form.
+ */
 static const uint8_t map2[] =
 {
-    0xff, 0xff, 0x3e, 0xff, 0xff, 0x34, 0x35, 0x36,
+    0x3e, 0xff, 0x3e, 0xff, 0x3f, 0x34, 0x35, 0x36,
     0x37, 0x38, 0x39, 0x3a, 0x3b, 0x3c, 0x3d, 0xff,
     0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x00, 0x01,
     0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09,