diff --git a/src/middleware.ts b/src/middleware.ts
index ba34fe2..fc79437 100644
--- a/src/middleware.ts
+++ b/src/middleware.ts
@@ -47,10 +47,11 @@ async function verifySession(token: string | undefined): Promise<boolean> {
   const adminPassword = process.env.ADMIN_PASSWORD
   if (!adminPassword) return false
   try {
-    // Session token format: base64(payload).hmac
+    // Session token format: base64url(payload).hmac
     const [payloadB64, signature] = token.split('.')
     if (!payloadB64 || !signature) return false
-    const payload = JSON.parse(Buffer.from(payloadB64, 'base64').toString())
+    // Use base64url to match the encoding in the login route
+    const payload = JSON.parse(Buffer.from(payloadB64, 'base64url').toString())
     if (payload.exp && Date.now() > payload.exp) return false
     // Verify HMAC
     const crypto = await import('crypto')