nats-io/nats-server · error

unable to decode privateBlob from base64: %v

Error message

unable to decode privateBlob from base64: %v

What it means

The private key field from the parsed natsTPMPersistedKeys JSON is not valid standard base64: base64.StdEncoding.Decode failed. This indicates the persisted keys file is corrupt or was hand-edited/rewritten with a non-standard encoding (e.g. raw or URL-safe base64), so the private blob needed to load the sealed object into the TPM cannot be recovered.

Source

Thrown at server/tpm/js_ek_tpm_windows.go:135

var tpmKeys natsTPMPersistedKeys
if err := json.Unmarshal(keysJSON, &tpmKeys); err != nil {
	return nil, nil, fmt.Errorf("unable to unmarshal TPM file keys JSON from %s: %v", filename, err)
}

// Base64 decode the private and public blobs.
privateBlob := make([]byte, base64.StdEncoding.DecodedLen(len(tpmKeys.PrivateKey)))
publicBlob := make([]byte, base64.StdEncoding.DecodedLen(len(tpmKeys.PublicKey)))
prn, err := base64.StdEncoding.Decode(privateBlob, tpmKeys.PrivateKey)
if err != nil {
	return nil, nil, fmt.Errorf("unable to decode privateBlob from base64: %v", err)
}
pun, err := base64.StdEncoding.Decode(publicBlob, tpmKeys.PublicKey)
if err != nil {
	return nil, nil, fmt.Errorf("unable to decode publicBlob from base64: %v", err)
}
return publicBlob[:pun], privateBlob[:prn], nil

View on GitHub (pinned to 3a66a489d2)

Solutions

1. Check the PrivateKey field in the keys file is valid standard base64 (padded, no URL-safe alphabet)
2. Restore the keys file from backup
3. Delete the corrupt file and restart to create and seal a new key (old sealed data becomes unrecoverable)

When it happens

Trigger: Thrown at server/tpm/js_ek_tpm_windows.go:135 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/4c52535b80146908. Report an issue: GitHub.