{"record":{"id":"fe9423c44a0f4cc9","repo":"gchq/CyberChef","slug":"error-base64-padding-character-pad-not-used","errorCode":null,"errorMessage":"Error: Base64 padding character (${pad}) not used in the correct place.","messagePattern":"Error: Base64 padding character \\((.+?)\\) not used in the correct place\\.","errorType":"validation","errorClass":"OperationError","httpStatus":null,"severity":"error","filePath":"src/core/lib/Base64.mjs","lineNumber":116,"sourceCode":"    // Remove non-alphabet characters\n    if (removeNonAlphChars) {\n        const re = new RegExp(\"[^\" + alphabet.replace(/[[\\]\\\\\\-^$]/g, \"\\\\$&\") + \"]\", \"g\");\n        data = data.replace(re, \"\");\n    }\n\n    if (strictMode) {\n        // Check for incorrect lengths (even without padding)\n        if (data.length % 4 === 1) {\n            throw new OperationError(`Error: Invalid Base64 input length (${data.length}). Cannot be 4n+1, even without padding chars.`);\n        }\n\n        if (alphabet.length === 65) { // Padding character included\n            const pad = alphabet.charAt(64);\n            const padPos = data.indexOf(pad);\n            if (padPos >= 0) {\n                // Check that the padding character is only used at the end and maximum of twice\n                if (padPos < data.length - 2 || data.charAt(data.length - 1) !== pad) {\n                    throw new OperationError(`Error: Base64 padding character (${pad}) not used in the correct place.`);\n                }\n\n                // Check that input is padded to the correct length\n                if (data.length % 4 !== 0) {\n                    throw new OperationError(\"Error: Base64 not padded to a multiple of 4.\");\n                }\n            }\n        }\n    }\n\n    const output = [];\n    let chr1, chr2, chr3,\n        enc1, enc2, enc3, enc4,\n        i = 0;\n\n    while (i < data.length) {\n        // Including `|| null` forces empty strings to null so that indexOf returns -1 instead of 0\n        enc1 = alphabet.indexOf(data.charAt(i++) || null);","sourceCodeStart":98,"sourceCodeEnd":134,"githubUrl":"https://github.com/gchq/CyberChef/blob/4290ea753912378913b1f3f54e0fc5720afeda5d/src/core/lib/Base64.mjs#L98-L134","documentation":"Thrown by fromBase64() in src/core/lib/Base64.mjs:116 under strictMode when the alphabet has a 65th padding character, that padding character is present in the input, but it is not used correctly: either it appears earlier than the last two positions (padPos < data.length - 2), or the final character is not the pad (data.charAt(data.length-1) !== pad). RFC 4648 permits padding only as a terminal suffix of one or two '=' characters.","triggerScenarios":"strictMode=true with a 65-char alphabet and input like 'AB=C' (pad before the last two positions), 'ABCAB==' where the trailing logic fails, or 'ABCA' followed by a pad somewhere in the middle. Concretely fromBase64('AB=CD', 'A-Za-z0-9+/=', 'byteArray', false, true): padPos=2, data.length-2=3, 2<3 so it throws.","commonSituations":"Hand-edited Base64 where '=' was inserted as a filler mid-string; URL parameters where '=' was URL-decoded into the wrong spot; mixed-up alphabets where a legitimate data char in one alphabet is the pad in another; concatenation of padded fragments.","solutions":["Inspect the input and move/strip '=' so it appears only as the last one or two characters.","If the input is genuinely unpadded, remove all '=' characters before calling.","Disable strictMode to tolerate misplaced padding (only if data integrity is otherwise assured).","Ensure removeNonAlphChars=true so non-alphabet noise does not shift the pad position."],"exampleFix":"// before - '=' in the wrong position\nfromBase64('AB=CD', 'A-Za-z0-9+/=', 'byteArray', false, true);\n\n// after - padding only at the end\nfromBase64('ABCD=', 'A-Za-z0-9+/=', 'byteArray', false, true);","handlingStrategy":"validation","validationCode":"function padPositionOk(data, pad) {\n  const padPos = data.indexOf(pad);\n  if (padPos < 0) return true;\n  return padPos >= data.length - 2 && data.charAt(data.length - 1) === pad;\n}\n// call before fromBase64 with strictMode=true","typeGuard":"function hasCanonicalPadding(s, pad='=') {\n  const i = s.indexOf(pad);\n  return i < 0 || (i >= s.length - 2 && s.endsWith(pad));\n}","tryCatchPattern":"try {\n  fromBase64(input, 'A-Za-z0-9+/=', 'byteArray', false, true);\n} catch (e) {\n  if (e instanceof OperationError && /padding character.*not used in the correct place/.test(e.message)) {\n    // re-pad or strip '='\n  }\n}","preventionTips":["Only ever append '=' at the very end (1 or 2 chars) when constructing Base64.","Use removeNonAlphChars=true so stray characters cannot shift the pad position.","Never insert '=' as a visual filler between data characters."],"tags":["base64","decoding","padding","strict-mode","input-validation"],"backgroundTag":null,"analyzedSha":"4290ea753912378913b1f3f54e0fc5720afeda5d","analyzedAt":"2026-08-13T06:05:50.210Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}