{"record":{"id":"4c52535b80146908","repo":"nats-io/nats-server","slug":"unable-to-decode-privateblob-from-base64-v","errorCode":null,"errorMessage":"unable to decode privateBlob from base64: %v","messagePattern":"unable to decode privateBlob from base64: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/tpm/js_ek_tpm_windows.go","lineNumber":135,"sourceCode":"var tpmKeys natsTPMPersistedKeys\nif err := json.Unmarshal(keysJSON, &tpmKeys); err != nil {\n\treturn nil, nil, fmt.Errorf(\"unable to unmarshal TPM file keys JSON from %s: %v\", filename, err)\n}\n\n// Base64 decode the private and public blobs.\nprivateBlob := make([]byte, base64.StdEncoding.DecodedLen(len(tpmKeys.PrivateKey)))\npublicBlob := make([]byte, base64.StdEncoding.DecodedLen(len(tpmKeys.PublicKey)))\nprn, err := base64.StdEncoding.Decode(privateBlob, tpmKeys.PrivateKey)\nif err != nil {\n\treturn nil, nil, fmt.Errorf(\"unable to decode privateBlob from base64: %v\", err)\n}\npun, err := base64.StdEncoding.Decode(publicBlob, tpmKeys.PublicKey)\nif err != nil {\n\treturn nil, nil, fmt.Errorf(\"unable to decode publicBlob from base64: %v\", err)\n}\nreturn publicBlob[:pun], privateBlob[:prn], nil","sourceCodeStart":117,"sourceCodeEnd":153,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/tpm/js_ek_tpm_windows.go#L117-L153","documentation":"The private key field from the parsed natsTPMPersistedKeys JSON is not valid standard base64: base64.StdEncoding.Decode failed. This indicates the persisted keys file is corrupt or was hand-edited/rewritten with a non-standard encoding (e.g. raw or URL-safe base64), so the private blob needed to load the sealed object into the TPM cannot be recovered.","triggerScenarios":"Thrown at server/tpm/js_ek_tpm_windows.go:135 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Check the PrivateKey field in the keys file is valid standard base64 (padded, no URL-safe alphabet)","Restore the keys file from backup","Delete the corrupt file and restart to create and seal a new key (old sealed data becomes unrecoverable)"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}