CSP Nonce Base64 Length Bits Check

Audit CSP nonce canonical Base64 decoded length only, bytes×8 is capacity not observed entropy; no nonce randomness, uniqueness or CSP effectiveness certification.

Description

A CSP nonce's encoded byte length is distinct from its unpredictable generation and per-response use.

A CSP nonce's encoded byte length is distinct from its unpredictable generation and per-response use.^[1]

The committed checker also contains a pad-bit indexing defect, so its acceptance result needs independent Base64 verification. Use CSP Nonce Base64 Length Bits Check to evaluate the supplied inputs under the specific model below.

When to use CSP Nonce Base64 Length Bits Check

Use CSP Nonce Base64 Length Bits Check to evaluate the supplied inputs under the specific model below. Choose the intended encoding, alphabet or check and keep the exact character, key and measurement conventions described below.

How to use CSP Nonce Base64 Length Bits Check and understand its results

Choose the intended encoding, alphabet or check and keep the exact character, key and measurement conventions described below.
Enter Nonce base64, Caller minimum decoded bits using the field table and validation rules below, then run the tool.
Read Decoded nonce bytes, Encoded bit capacity, Meets caller length floor and interpret units, signs, ordering and placeholders as explained below.
If the tool reports an input error, correct that field and rerun. A successful false result, empty match list or unknown-evidence placeholder has the specific meaning described here; check the limitations before applying the result.

Input field	Meaning	Value type	Requirement
nonceBase64	Nonce base64	string	Required; constraints below
callerMinimumDecodedBits	Caller minimum decoded bits	number	Required; constraints below

Enter a nonempty standard Base64-shaped nonce of at most 5464 characters, with length divisible by 4 and required trailing padding, plus an integer minimum from 0 to 32768 bits. The tool checks formatting, attempts unused-pad-bit validation, then computes bytes=(length/4)×3−padding and capacity=8×bytes. The committed pad-bit alphabet contains an extra space after Z: canonical AAc= is rejected and noncanonical AAb= is accepted. Therefore its acceptance is not a reliable canonical-Base64 verdict. Reported capacity measures encoded length, not observed entropy or nonce unpredictability.

decodedBytes = encodedLength/4×3−padding; capacityBits = 8×decodedBytes; meetsFloor = capacityBits≥callerMinimum

Field order, units and branch conditions follow the implementation explanation above.

Output field	Meaning	Value type
decodedNonceBytes	Decoded byte length inferred from encoding length and padding; no entropy assessment.	number
encodedBitCapacity	Eight times inferred byte length; capacity in bits, not measured randomness.	number
meetsCallerLengthFloor	True when capacity is at least the caller’s floor, including equality.	boolean

json

{
  "input": {
    "nonceBase64": "AQIDBA==",
    "callerMinimumDecodedBits": 32
  },
  "output": {
    "decodedNonceBytes": 4,
    "encodedBitCapacity": 32,
    "meetsCallerLengthFloor": true
  }
}

Limitations and assumptions

Known implementation defect: the extra space in its internal Base64 alphabet shifts lowercase-letter and later symbol indices. At this commit, AAc= fails although its unused bits are canonical, while AAb= succeeds despite nonzero unused bits. Do not rely on this tool as a canonical Base64 validator; use an independently verified implementation. It does not generate nonces, test unpredictable randomness or reuse, or inspect a CSP policy.^{[2, 3]}

The committed checker also contains a pad-bit indexing defect, so its acceptance result needs independent Base64 verification. Apply the exact scope and assumptions described above.

All listed fields require explicit values. Unexpected fields, incorrect types, nonfinite numbers and sparse arrays fail validation. Domain-specific bounds, alignments and supported tokens are stated above; extremely large inputs or outputs can also be rejected. These errors differ from successful results such as false, no matches or unknown evidence.

Alternative or Complementary methods

Use TOTP Secret Base32 Padding Check for a related task: Base32 encodes bytes as alphabet symbols with optional format-specific padding.

Use Pad Byte Monobit Randomness Check for a related task: A monobit statistic compares the counts of zero and one bits.

References

CSP Nonce Base64 Length Bits Check — tool.io
RFC 4648: Base-N Encodings — IETF
Content Security Policy Level 3: nonce security considerations — W3C

Similar or alternative tools

TOTP Secret Base32 Padding Check
Base32 encodes bytes as alphabet symbols with optional format-specific padding.
Pad Byte Monobit Randomness Check
A monobit statistic compares the counts of zero and one bits.