{"record":{"id":"4712e0c8da94e98a","repo":"moonD4rk/HackBrowserData","slug":"base64-decode-encrypted-key-w","errorCode":null,"errorMessage":"base64 decode encrypted_key: %w","messagePattern":"base64 decode encrypted_key: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"masterkey/retriever_windows.go","lineNumber":31,"sourceCode":")\n\n// DPAPIRetriever unwraps Chrome's Local State os_crypt.encrypted_key via Windows DPAPI.\ntype DPAPIRetriever struct{}\n\nfunc (r *DPAPIRetriever) RetrieveKey(hints Hints) ([]byte, error) {\n\tdata, err := os.ReadFile(hints.LocalStatePath)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"read Local State: %w\", err)\n\t}\n\n\tencryptedKey := gjson.GetBytes(data, \"os_crypt.encrypted_key\")\n\tif !encryptedKey.Exists() {\n\t\treturn nil, fmt.Errorf(\"os_crypt.encrypted_key not found in Local State\")\n\t}\n\n\tkeyBytes, err := base64.StdEncoding.DecodeString(encryptedKey.String())\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"base64 decode encrypted_key: %w\", err)\n\t}\n\n\tconst dpapiPrefix = \"DPAPI\"\n\tif len(keyBytes) <= len(dpapiPrefix) {\n\t\treturn nil, fmt.Errorf(\"encrypted_key too short: %d bytes\", len(keyBytes))\n\t}\n\tif string(keyBytes[:len(dpapiPrefix)]) != dpapiPrefix {\n\t\treturn nil, fmt.Errorf(\"encrypted_key unexpected prefix: got %q, want %q\", keyBytes[:len(dpapiPrefix)], dpapiPrefix)\n\t}\n\n\tmasterKey, err := crypto.DecryptDPAPI(keyBytes[len(dpapiPrefix):])\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"DPAPI decrypt: %w\", err)\n\t}\n\treturn masterKey, nil\n}\n\n// DefaultRetrievers wires the Windows tiers: DPAPI for v10, ABE for v20 (Chrome 127+, via reflective","sourceCodeStart":13,"sourceCodeEnd":49,"githubUrl":"https://github.com/moonD4rk/HackBrowserData/blob/0503d04d7a8d0379d060268a74f1b149e5a0aad5/masterkey/retriever_windows.go#L13-L49","documentation":"RetrieveKey in masterkey/retriever_windows.go reads Chrome's Local State file and base64-decodes the os_crypt.encrypted_key value. This error means the stored value is not valid standard base64, so DecodeString failed before any DPAPI work could start. It indicates the Local State JSON is corrupt, truncated, or the field was extracted/modified incorrectly.","triggerScenarios":"os.ReadFile succeeded on Local State and gjson found os_crypt.encrypted_key, but base64.StdEncoding.DecodeString on the value failed (illegal characters, wrong padding, whitespace, or the value was double-escaped/JSON-mangled).","commonSituations":"A partially written or corrupted Local State from a crashed browser; a hand-edited or tool-modified Local State; running against a fake/fixture Local State with placeholder values; the encrypted_key containing URL-safe base64 characters (-/_) instead of standard base64.","solutions":["Re-open the target browser so Chrome rewrites a clean Local State, then retry.","Verify os_crypt.encrypted_key in the Local State JSON is a single-line standard-base64 string with no whitespace or escapes (e.g. with `jq -r '.os_crypt.encrypted_key'` and piping to `base64 -d`).","Delete the corrupt profile's Local State and let the browser regenerate it (note: cookies become undecryptable until re-login).","Confirm you are pointing hints.LocalStatePath at the correct profile's Local State, not a different browser's file with a different schema."],"exampleFix":"// before (URL-safe base64 value fails StdEncoding)\nkeyBytes, err := base64.StdEncoding.DecodeString(encryptedKey.String())\n// after (tolerate URL-safe alphabet too)\nkeyBytes, err := base64.StdEncoding.WithPadding(base64.StdPadding).DecodeString(strings.NewReplacer(\"-\", \"+\", \"_\", \"/\").Replace(encryptedKey.String()))","handlingStrategy":"validation","validationCode":"v := gjson.GetBytes(localState, \"os_crypt.encrypted_key\").String()\nif v == \"\" { return errors.New(\"encrypted_key missing/empty\") }\nif _, err := base64.StdEncoding.DecodeString(v); err != nil {\n\treturn fmt.Errorf(\"encrypted_key not valid std base64: %w\", err)\n}","typeGuard":"func validBase64(s string) bool {\n\t_, err := base64.StdEncoding.DecodeString(s)\n\treturn s != \"\" && err == nil\n}","tryCatchPattern":"key, err := retriever.RetrieveKey(hints)\nvar b64Err *base64.CorruptInputError\nif err != nil && errors.As(err, &b64Err) {\n\t// regenerate Local State or fall back to ABE retriever\n}","preventionTips":["Never hand-edit Local State; let the browser write it.","Validate base64 with a quick decode before downstream DPAPI work.","Point LocalStatePath at the exact profile directory."],"tags":["base64","dpapi","chromium","windows"],"backgroundTag":"invalid-argument-format","analyzedSha":"0503d04d7a8d0379d060268a74f1b149e5a0aad5","analyzedAt":"2026-09-06T13:38:28.707Z","contentChangedAt":"2026-09-06T13:38:28.707Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}