As one might imagine, the base64 encoding was an untested last-minute change that I am not using in my production code because of the overhead.

Keeping the identity (say, just a username) in clear text also allows for some neat features, such as the ability to read it out via Javascript and update otherwise static HTML with a seemingly dynamic header. I'll save that for another post.

In line 189 (writing the cookie): you base64_encode() the $contents _after_ you've created the MD5 hash.

In line 166 (reading the cookie): you don't base64_decode() the $contents before performing the MD5 to compare against the checksum held in the cookie.

Line 166-167 should be:
if (md5(base64_decode($contents) . $now . $this->_secret) == $checksum) {
$this->_cached = $contents;
}

~ Cliff