gchq/CyberChef · error · OperationError

Error: Base64 padding character (${pad}) not used in the cor

Error message

Error: Base64 padding character (${pad}) not used in the correct place.

What it means

Thrown by fromBase64() in src/core/lib/Base64.mjs:116 under strictMode when the alphabet has a 65th padding character, that padding character is present in the input, but it is not used correctly: either it appears earlier than the last two positions (padPos < data.length - 2), or the final character is not the pad (data.charAt(data.length-1) !== pad). RFC 4648 permits padding only as a terminal suffix of one or two '=' characters.

Source

Thrown at src/core/lib/Base64.mjs:116

    // Remove non-alphabet characters
    if (removeNonAlphChars) {
        const re = new RegExp("[^" + alphabet.replace(/[[\]\\\-^$]/g, "\\$&") + "]", "g");
        data = data.replace(re, "");
    }

    if (strictMode) {
        // Check for incorrect lengths (even without padding)
        if (data.length % 4 === 1) {
            throw new OperationError(`Error: Invalid Base64 input length (${data.length}). Cannot be 4n+1, even without padding chars.`);
        }

        if (alphabet.length === 65) { // Padding character included
            const pad = alphabet.charAt(64);
            const padPos = data.indexOf(pad);
            if (padPos >= 0) {
                // Check that the padding character is only used at the end and maximum of twice
                if (padPos < data.length - 2 || data.charAt(data.length - 1) !== pad) {
                    throw new OperationError(`Error: Base64 padding character (${pad}) not used in the correct place.`);
                }

                // Check that input is padded to the correct length
                if (data.length % 4 !== 0) {
                    throw new OperationError("Error: Base64 not padded to a multiple of 4.");
                }
            }
        }
    }

    const output = [];
    let chr1, chr2, chr3,
        enc1, enc2, enc3, enc4,
        i = 0;

    while (i < data.length) {
        // Including `|| null` forces empty strings to null so that indexOf returns -1 instead of 0
        enc1 = alphabet.indexOf(data.charAt(i++) || null);

View on GitHub (pinned to 4290ea7539)

Solutions

1. Inspect the input and move/strip '=' so it appears only as the last one or two characters.
2. If the input is genuinely unpadded, remove all '=' characters before calling.
3. Disable strictMode to tolerate misplaced padding (only if data integrity is otherwise assured).
4. Ensure removeNonAlphChars=true so non-alphabet noise does not shift the pad position.

Example fix

// before - '=' in the wrong position
fromBase64('AB=CD', 'A-Za-z0-9+/=', 'byteArray', false, true);

// after - padding only at the end
fromBase64('ABCD=', 'A-Za-z0-9+/=', 'byteArray', false, true);

function padPositionOk(data, pad) {
  const padPos = data.indexOf(pad);
  if (padPos < 0) return true;
  return padPos >= data.length - 2 && data.charAt(data.length - 1) === pad;
}
// call before fromBase64 with strictMode=true

function hasCanonicalPadding(s, pad='=') {
  const i = s.indexOf(pad);
  return i < 0 || (i >= s.length - 2 && s.endsWith(pad));
}

try {
  fromBase64(input, 'A-Za-z0-9+/=', 'byteArray', false, true);
} catch (e) {
  if (e instanceof OperationError && /padding character.*not used in the correct place/.test(e.message)) {
    // re-pad or strip '='
  }
}

When it happens

Trigger: strictMode=true with a 65-char alphabet and input like 'AB=C' (pad before the last two positions), 'ABCAB==' where the trailing logic fails, or 'ABCA' followed by a pad somewhere in the middle. Concretely fromBase64('AB=CD', 'A-Za-z0-9+/=', 'byteArray', false, true): padPos=2, data.length-2=3, 2<3 so it throws.

Common situations: Hand-edited Base64 where '=' was inserted as a filler mid-string; URL parameters where '=' was URL-decoded into the wrong spot; mixed-up alphabets where a legitimate data char in one alphabet is the pad in another; concatenation of padded fragments.

Related errors

• Error: Base64 not padded to a multiple of 4.
• Error: Invalid Base64 input length (${data.length}). Cannot
• Error: Base64 input contains non-alphabet char(s)
• Invalid padding: too many bits remaining
• Error: Base64 alphabet should be 64 characters long, or 65 w

AI-assisted analysis of gchq/CyberChef@4290ea7539 (2026-08-13). Data as JSON: /api/errors/fe9423c44a0f4cc9. Report an issue: GitHub.