What causes "abe: base64 decode: %w" in moonD4rk/HackBrowserData?

Inspect the os_crypt.app_bound_encrypted_key value in Local State and confirm it is valid standard base64.

abe: base64 decode: %w

Error message

abe: base64 decode: %w

What it means

After reading Local State, loadEncryptedKey base64-decodes the app_bound_encrypted_key string. This error wraps a base64.StdEncoding.DecodeString failure, meaning the JSON field did not contain valid standard base64 text.

Source

Thrown at masterkey/abe_windows.go:86

}

func loadEncryptedKey(localStatePath string) ([]byte, error) {
	if localStatePath == "" {
		return nil, errNoABEKey
	}
	data, err := os.ReadFile(localStatePath)
	if err != nil {
		return nil, fmt.Errorf("abe: read Local State: %w", err)
	}

	raw := gjson.GetBytes(data, "os_crypt.app_bound_encrypted_key")
	if !raw.Exists() {
		return nil, errNoABEKey
	}

	decoded, err := base64.StdEncoding.DecodeString(raw.String())
	if err != nil {
		return nil, fmt.Errorf("abe: base64 decode: %w", err)
	}
	if len(decoded) <= len(appbPrefix) {
		return nil, fmt.Errorf("abe: encrypted key too short: %d bytes", len(decoded))
	}
	for i, b := range appbPrefix {
		if decoded[i] != b {
			return nil, fmt.Errorf("abe: unexpected prefix: got %q, want %q",
				decoded[:len(appbPrefix)], appbPrefix)
		}
	}
	return decoded[len(appbPrefix):], nil
}

View on GitHub (pinned to 0503d04d7a)

Solutions

Inspect the os_crypt.app_bound_encrypted_key value in Local State and confirm it is valid standard base64.
Restore/copy a fresh Local State from the affected Chrome profile, or reinstall/repair Chrome if the profile is corrupt.
Confirm you are reading the right JSON field (not encrypted_key vs app_bound_encrypted_key) and that no surrounding quotes/whitespace were added.
For robustness, try base64.RawStdEncoding as a fallback if the payload lacks padding.

Defensive patterns

Strategy: validation

Validate before calling

v := gjson.Get(localStateJSON, "os_crypt.app_bound_encrypted_key").String()
if _, err := base64.StdEncoding.DecodeString(strings.TrimSpace(v)); err != nil {
	return fmt.Errorf("app_bound_encrypted_key is not valid base64: %w", err)
}

Try / catch

key, err := RetrieveKey(exePath, localStatePath)
if err != nil {
	if strings.Contains(err.Error(), "base64 decode") {
		log.Warnf("Local State key blob corrupt: %v", err)
		return fallbackDecrypt()
	}
	return err
}

Prevention

Never hand-edit Local State; regenerate it via Chrome if corrupted.
Trim whitespace/newlines before decoding values extracted from JSON.
Verify the field content with a quick base64 validation in tests using synthetic Local State fixtures.

When it happens

Trigger: Calling RetrieveKey when the Local State file contains a malformed app_bound_encrypted_key value (corrupted profile, hand-edited file, non-standard JSON content, or the field holding something other than base64 key material).

Common situations: Corrupted or truncated Chrome profile; tests with synthetic Local State containing invalid base64; parsing the wrong JSON field or an escaped/quoting issue when the file was generated by another tool.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

Related errors

AI-assisted analysis of moonD4rk/HackBrowserData@0503d04d7a (2026-09-06). Data as JSON: /api/errors/8e1ae5c02408a5d3. Report an issue: GitHub.