The padding '=' characters at the end are considered optional, but if any\n * are present, there must be the correct number of them.\n *\n * @param input the data to decode\n * @param offset the position within the input array at which to start\n * @param len the number of bytes of input to decode\n * @param flags controls certain features of the decoded output. Pass {@code DEFAULT} to decode\n * standard Base64.\n * @return decoded bytes for given offset and length\n * @throws IllegalArgumentException if the input contains incorrect padding\n */\n public static byte[] decode(byte[] input, int offset, int len, int flags) {\n // Allocate space for the most data the input could represent.\n // (It could contain less if it contains whitespace, etc.)\n Decoder decoder = new Decoder(flags, new byte[len * 3 / 4]);\n\n if (!decoder.process(input, offset, len, true)) {\n throw new IllegalArgumentException(\"bad base-64\");\n }\n\n // Maybe we got lucky and allocated exactly enough output space.\n if (decoder.op == decoder.output.length) {\n return decoder.output;\n }\n\n // Need to shorten the array, so allocate a new one of the\n // right size and copy.\n byte[] temp = new byte[decoder.op];\n System.arraycopy(decoder.output, 0, temp, 0, decoder.op);\n return temp;\n }\n\n /**\n * Base64-encode the given data and return a newly allocated String with the result.\n *\n * @param input the data to encode","sourceCodeStart":103,"sourceCodeEnd":139,"githubUrl":"https://github.com/android-async-http/android-async-http/blob/018a0b8d96a0dd569de9f8128cfe5d030e0423ef/library/src/main/java/com/loopj/android/http/Base64.java#L103-L139","documentation":"Base64.decode throws IllegalArgumentException('bad base-64') when Decoder.process rejects the input, meaning the byte array or flags combination is not valid Base64 (illegal characters, bad padding, or data truncated mid-quantum). This is a port of Android's android.util.Base64 bundled so the library can decode Basic-auth and other values.","triggerScenarios":"Calling Base64.decode with a byte[] containing characters outside the Base64 alphabet, incorrect padding, or a length not consistent with the flags; decoding data that was not actually Base64-encoded; mixing URL_SAFE vs standard flags with mismatched input.","commonSituations":"Decoding a Basic auth header segment extracted incorrectly (includes 'Basic ' prefix); decoding server data that contains whitespace/newlines with the wrong flag combination; input that was hex- or percent-encoded rather than Base64.","solutions":["Validate the input matches ^[A-Za-z0-9+/=]*$ (or URL-safe alphabet with -_) before decoding","Strip non-Base64 framing such as 'Basic ' prefix, PEM headers, or data: URIs","Use NO_WRAP and matching flags for the encoding used (URL_SAFE with URL-safe input)","Use CRLF/NO_PADDING flags consistent with how the data was encoded"],"exampleFix":"// before\nbyte[] decoded = Base64.decode(headerValue.getBytes(), Base64.DEFAULT); // 'Basic dXNlcjpwYXNz'\n// after\nString b64 = headerValue.replaceFirst(\"^Basic\\\\s+\", \"\").trim();\nbyte[] decoded = Base64.decode(b64.getBytes(), Base64.NO_WRAP);","handlingStrategy":"validation","validationCode":"String b64 = raw.replaceFirst(\"^Basic\\\\s+\", \"\").trim();\nif (!b64.matches(\"^[A-Za-z0-9+/=_-]*$\")) { throw new IllegalArgumentException(\"not base64\"); }\nbyte[] decoded = Base64.decode(b64.getBytes(), Base64.DEFAULT);","typeGuard":"boolean looksLikeBase64(byte[] in) {\n for (byte c : in) {\n if (!((c >= 'A' && c <= 'Z') || (c >= 'a' && c <= 'z') || (c >= '0' && c <= '9') || c == '+' || c == '/' || c == '=' || c == '-' || c == '_')) return false;\n }\n return true;\n}","tryCatchPattern":"try { decoded = Base64.decode(input, Base64.DEFAULT); } catch (IllegalArgumentException e) { /* log and treat input as malformed */ }","preventionTips":["Strip framing like 'Basic ' or PEM armor before decoding","Match decode flags (DEFAULT, NO_WRAP, URL_SAFE, NO_PADDING) to how the data was encoded","Validate input alphabet before decoding user/server-supplied data"],"tags":["android","base64","decoding","invalid-input"],"backgroundTag":"invalid-argument-format","analyzedSha":"018a0b8d96a0dd569de9f8128cfe5d030e0423ef","analyzedAt":"2026-09-09T15:22:01.829Z","contentChangedAt":"2026-09-09T15:22:01.829Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}