in src/utils.js [83:92]
export function base64urlToBytes(str) {
// XXX TODO: try to use something constant-time, in case calling code
// uses it to decode secrets?
str = atob(str.replace(/-/g, '+').replace(/_/g, '/'));
const bytes = new Uint8Array(str.length);
for (let i = 0; i < str.length; i++) {
bytes[i] = str.charCodeAt(i);
}
return bytes;
}