nats-io/nats-server · error

unable to decode publicBlob from base64: %v

Error message

unable to decode publicBlob from base64: %v

What it means

The public key field from the parsed natsTPMPersistedKeys JSON is not valid standard base64: base64.StdEncoding.Decode of tpmKeys.PublicKey failed. The keys file is corrupt or was re-encoded differently, so the public blob required by tpm2.Load cannot be recovered.

Source

Thrown at server/tpm/js_ek_tpm_windows.go:139

// Base64 decode the private and public blobs.
privateBlob := make([]byte, base64.StdEncoding.DecodedLen(len(tpmKeys.PrivateKey)))
publicBlob := make([]byte, base64.StdEncoding.DecodedLen(len(tpmKeys.PublicKey)))
prn, err := base64.StdEncoding.Decode(privateBlob, tpmKeys.PrivateKey)
if err != nil {
	return nil, nil, fmt.Errorf("unable to decode privateBlob from base64: %v", err)
}
pun, err := base64.StdEncoding.Decode(publicBlob, tpmKeys.PublicKey)
if err != nil {
	return nil, nil, fmt.Errorf("unable to decode publicBlob from base64: %v", err)
}
return publicBlob[:pun], privateBlob[:prn], nil

View on GitHub (pinned to 3a66a489d2)

Solutions

1. Check the PublicKey field in the keys file is valid standard base64 (padded, no URL-safe alphabet)
2. Restore the keys file from backup
3. Delete the corrupt file and restart to create and seal a new key (old sealed data becomes unrecoverable)

When it happens

Trigger: Thrown at server/tpm/js_ek_tpm_windows.go:139 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/7cfc454649d659de. Report an issue: GitHub.