diff --git a/barbican/plugin/util/translations.py b/barbican/plugin/util/translations.py
index cf97f2643..d517c4f09 100644
--- a/barbican/plugin/util/translations.py
+++ b/barbican/plugin/util/translations.py
@@ -60,7 +60,10 @@ def normalize_before_encryption(unencrypted, content_type, content_encoding,
         if not content_encoding:
             b64payload = base64.encode_as_bytes(unencrypted)
         elif content_encoding.lower() == 'base64':
-            b64payload = unencrypted
+            if not isinstance(unencrypted, six.binary_type):
+                b64payload = unencrypted.encode('utf-8')
+            else:
+                b64payload = unencrypted
         elif enforce_text_only:
             # For text-based protocols (such as the one-step secret POST),
             #   only 'base64' encoding is possible/supported.
diff --git a/barbican/tests/plugin/util/test_translations.py b/barbican/tests/plugin/util/test_translations.py
index 7e33f5e65..6f1e8be54 100644
--- a/barbican/tests/plugin/util/test_translations.py
+++ b/barbican/tests/plugin/util/test_translations.py
@@ -174,6 +174,28 @@ class WhenNormalizingBeforeEncryption(utils.BaseTestCase):
         self.assertEqual(base64.encode_as_bytes('bam'), unencrypted)
         self.assertEqual('application/octet-stream', content_type)
 
+    def test_can_normalize_base64_str(self):
+        unencrypted, content_type = self.normalize(
+            unencrypted=base64.encode_as_bytes('stuff').decode('utf-8'),
+            content_type='application/octet-stream',
+            content_encoding='base64',
+            secret_type=s.SecretType.OPAQUE
+        )
+
+        self.assertEqual(base64.encode_as_bytes('stuff'), unencrypted)
+        self.assertEqual('application/octet-stream', content_type)
+
+    def test_can_normalize_base64_bytes(self):
+        unencrypted, content_type = self.normalize(
+            unencrypted=base64.encode_as_bytes('stuff'),
+            content_type='application/octet-stream',
+            content_encoding='base64',
+            secret_type=s.SecretType.OPAQUE
+        )
+
+        self.assertEqual(base64.encode_as_bytes('stuff'), unencrypted)
+        self.assertEqual('application/octet-stream', content_type)
+
     @utils.parameterized_dataset(dataset_for_raised_exceptions)
     def test_normalize_raising_exceptions_with(self, exception, **kwargs):
         self.assertRaises(exception, self.normalize, **kwargs)