{"record":{"id":"3256c6fde719da6b","repo":"jwtk/jjwt","slug":"unable-to-base64url-decode-inputstream-t-getmes","errorCode":null,"errorMessage":"Unable to Base64Url-decode InputStream: ${t.getMessage()}","messagePattern":"Unable to Base64Url-decode InputStream: (.+?)","errorType":"validation","errorClass":"io.jsonwebtoken.io.DecodingException","httpStatus":null,"severity":"error","filePath":"impl/src/main/java/io/jsonwebtoken/impl/io/DelegateStringDecoder.java","lineNumber":43,"sourceCode":"@SuppressWarnings(\"DeprecatedIsStillUsed\")\n@Deprecated //TODO: delete when deleting JwtParserBuilder#base64UrlDecodeWith\npublic class DelegateStringDecoder implements Decoder<InputStream, InputStream> {\n\n    private final Decoder<CharSequence, byte[]> delegate;\n\n    public DelegateStringDecoder(Decoder<CharSequence, byte[]> delegate) {\n        this.delegate = Assert.notNull(delegate, \"delegate cannot be null.\");\n    }\n\n    @Override\n    public InputStream decode(InputStream in) throws DecodingException {\n        try {\n            byte[] data = Streams.bytes(in, \"Unable to Base64URL-decode input.\");\n            data = delegate.decode(Strings.utf8(data));\n            return Streams.of(data);\n        } catch (Throwable t) {\n            String msg = \"Unable to Base64Url-decode InputStream: \" + t.getMessage();\n            throw new DecodingException(msg, t);\n        }\n    }\n}\n","sourceCodeStart":25,"sourceCodeEnd":47,"githubUrl":"https://github.com/jwtk/jjwt/blob/fb71496164c71442d08adec4571d9616ed5e1b8d/impl/src/main/java/io/jsonwebtoken/impl/io/DelegateStringDecoder.java#L25-L47","documentation":"Thrown as a DecodingException when the bytes of an InputStream cannot be Base64Url-decoded. The method reads the stream, converts to a UTF-8 string, and delegates to a base64url codec; any failure (invalid characters, IO error reading the stream) is wrapped with this message.","triggerScenarios":"Calling decode(InputStream) on DelegateStringDecoder (used when serializing/parsing JWT components from streams) with content that is not valid base64url, or when Streams.bytes fails reading the input.","commonSituations":"Passing a JWT payload that includes standard Base64 characters ('+', '/', '='); passing plain JSON instead of the encoded segment; a closed or broken InputStream underneath.","solutions":["Check the cause of the exception; invalid base64url characters are the most common root cause.","Normalize the input to base64url (replace '+' with '-', '/' with '_', strip '=' padding) before decoding.","Confirm you are passing the encoded JWT segment, not the decoded JSON payload.","Verify the InputStream is open and fully readable."],"exampleFix":"// before\nbyte[] out = decoder.decode(new ByteArrayInputStream(standardBase64Payload));\n// after\nString b64url = standardBase64Payload.replace('+', '-').replace('/', '_').replaceAll(\"=+$\", \"\");\nbyte[] out = decoder.decode(new ByteArrayInputStream(b64url.getBytes(StandardCharsets.UTF_8)));","handlingStrategy":"validation","validationCode":"// Java\nif (input == null || !input.available() > 0) throw new IllegalArgumentException(\"empty input\");\nString s = new String(bytes, StandardCharsets.UTF_8);\nif (!s.matches(\"[A-Za-z0-9_-]*\")) throw new IllegalArgumentException(\"not base64url\");","typeGuard":"static boolean isDecodableBase64Url(byte[] bytes) {\n    if (bytes == null || bytes.length == 0) return false;\n    return new String(bytes, StandardCharsets.UTF_8).matches(\"[A-Za-z0-9_-]*\");\n}","tryCatchPattern":"try {\n    InputStream decoded = delegateDecoder.decode(in);\n} catch (DecodingException e) {\n    throw new IllegalArgumentException(\"Input is not valid base64url: \" + e.getMessage(), e);\n}","preventionTips":["Validate the character set of base64url inputs before streaming them to the decoder.","Ensure standard-Base64 inputs from external systems are converted to base64url first.","Confirm streams are freshly created and not already consumed.","Preserve the original cause when logging decode failures."],"tags":["base64url","decoding","stream","io"],"backgroundTag":"json-decode-failed","analyzedSha":"fb71496164c71442d08adec4571d9616ed5e1b8d","analyzedAt":"2026-09-09T00:33:09.982Z","contentChangedAt":"2026-09-09T00:33:09.982Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}