What causes "ciphertext is not a multiple of the block size" in moonD4rk/HackBrowserData?

Check len(ciphertext)%16 == 0 before calling and skip invalid records.

ciphertext is not a multiple of the block size

Error message

ciphertext is not a multiple of the block size

What it means

errInvalidBlockSize is returned by cbcDecrypt when the ciphertext length is not a whole multiple of the AES block size (16 bytes). Block ciphers operate on complete blocks, so an input of any other length cannot be valid CBC ciphertext. The error fires early, before decryption and padding validation are attempted.

Source

Thrown at crypto/errors.go:8

package crypto

import "errors"

// Sentinel errors for crypto operations.
var (
	errShortCiphertext   = errors.New("ciphertext too short")
	errInvalidBlockSize  = errors.New("ciphertext is not a multiple of the block size")
	errInvalidIVLength   = errors.New("IV length must equal block size")
	errInvalidPadding    = errors.New("invalid PKCS5 padding")
	errInvalidNonceLen   = errors.New("nonce length must equal GCM nonce size")
	errUnsupportedIVLen  = errors.New("unsupported IV length")
	errDecodeASN1        = errors.New("failed to decode ASN1 data")
	errDPAPINotSupported = errors.New("DPAPI not supported on this platform") //nolint:unused // used on darwin/linux only
)

View on GitHub (pinned to 0503d04d7a)

Solutions

Check len(ciphertext)%16 == 0 before calling and skip invalid records.
Re-verify base64 decoding (strip whitespace, use StdEncoding vs RawStdEncoding correctly).
Re-copy the browser database; SQLite rows read from a live/locked file can be torn.
Confirm you are passing the encrypted column, not a plaintext value.

Example fix

// before
decrypted, err := crypto.DecryptChromiumCBC(key, blob)
// after
if len(blob)%aes.BlockSize != 0 {
    // skip or treat as plaintext
} else {
    decrypted, err := crypto.DecryptChromiumCBC(key, blob)
}

Defensive patterns

Strategy: validation

Validate before calling

if len(ct)%16 != 0 { return fmt.Errorf("ciphertext len %d not block-aligned", len(ct)) }

Type guard

func isBlockAligned(ct []byte, bs int) bool { return len(ct) > 0 && len(ct)%bs == 0 }

Try / catch

out, err := crypto.DecryptChromiumCBC(key, iv, ct)
if errors.Is(err, crypto.ErrInvalidBlockSize) {
    // skip record or re-decode base64
    return nil
}

Prevention

Assert block alignment before calling any CBC decrypt.
Strip whitespace/newlines before base64 decoding.
Copy databases while the browser is closed to avoid torn reads.
Distinguish encrypted vs plaintext columns (value vs decrypted_value).

When it happens

Trigger: Calling DecryptChromiumCBC (or any CBC path) with a blob whose length % 16 != 0 — typically incorrect base64 decoding, truncation, or a plaintext (non-encrypted) value passed in.

Common situations: Corrupted or partially-read cookie/login rows; whitespace/newlines corrupting base64 decoding; mixing up the encrypted 'value' with the plaintext 'decrypted_value' column from Chromium databases.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

Related errors

AI-assisted analysis of moonD4rk/HackBrowserData@0503d04d7a (2026-09-06). Data as JSON: /api/errors/e2527203eb1a4a37. Report an issue: GitHub.