{"record":{"id":"6f85bf41813c11a5","repo":"jwtk/jjwt","slug":"strict-decoding-last-encoded-character-before-th-6f85bf","errorCode":null,"errorMessage":"Strict decoding: Last encoded character (before the paddings if any) is a valid base 64 alphabet but not a possible encoding. Decoding requires at least two trailing 6-bit characters to create bytes.","messagePattern":"Strict decoding: Last encoded character \\(before the paddings if any\\) is a valid base 64 alphabet but not a possible encoding\\. Decoding requires at least two trailing 6-bit characters to create bytes\\.","errorType":"validation","errorClass":"java.lang.IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"impl/src/main/java/io/jsonwebtoken/impl/io/Base64Codec.java","lineNumber":789,"sourceCode":"     */\n    private void validateCharacter(final int emptyBitsMask, final Context context) {\n        if (isStrictDecoding() && (context.ibitWorkArea & emptyBitsMask) != 0) {\n            throw new IllegalArgumentException(\n                    \"Strict decoding: Last encoded character (before the paddings if any) is a valid \" +\n                            \"base 64 alphabet but not a possible encoding. \" +\n                            \"Expected the discarded bits from the character to be zero.\");\n        }\n    }\n\n    /**\n     * Validates whether decoding allows an entire final trailing character that cannot be\n     * used for a complete byte.\n     *\n     * @throws IllegalArgumentException if strict decoding is enabled\n     */\n    private void validateTrailingCharacter() {\n        if (isStrictDecoding()) {\n            throw new IllegalArgumentException(\n                    \"Strict decoding: Last encoded character (before the paddings if any) is a valid \" +\n                            \"base 64 alphabet but not a possible encoding. \" +\n                            \"Decoding requires at least two trailing 6-bit characters to create bytes.\");\n        }\n    }\n\n}\n","sourceCodeStart":771,"sourceCodeEnd":797,"githubUrl":"https://github.com/jwtk/jjwt/blob/fb71496164c71442d08adec4571d9616ed5e1b8d/impl/src/main/java/io/jsonwebtoken/impl/io/Base64Codec.java#L771-L797","documentation":"Error \"Strict decoding: Last encoded character (before the paddings if any) is a valid base 64 alphabet but not a possible encoding. Decoding requires at least two trailing 6-bit characters to create bytes.\" thrown in jwtk/jjwt.","triggerScenarios":"Thrown at impl/src/main/java/io/jsonwebtoken/impl/io/Base64Codec.java:789 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Ensure the Base64 input is complete: the final quantum must contain at least two Base64 characters (the encoded data may be truncated — check transport/serialization for dropped characters)","Re-encode the source bytes with a canonical Base64 encoder","Pad or fix the encoded string at the source; do not append arbitrary characters to 'fix' the length, as that changes the decoded bytes"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"fb71496164c71442d08adec4571d9616ed5e1b8d","analyzedAt":"2026-09-09T00:33:09.982Z","contentChangedAt":"2026-09-09T00:33:09.982Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}