setting the env. variable `MINIO_KMS_SECRET_KEY`. It expects the following
format:

```sh
MINIO_KMS_SECRET_KEY=<key-name>:<base64-value>
```

First generate a 256 bit random key via:

```sh
$ cat /dev/urandom | head -c 32 | base64 -
OSMM+vkKUTCvQs9YL/CVMIMt43HFhkUpqJxTmGl6rYw=
```

Now, you can set `MINIO_KMS_SECRET_KEY` like this:

```sh

                .setRedirectUri(getOicRedirectUrl())//
                .setState(state)//
                .build();
    }

    /**
     * Decodes a Base64 string to bytes.
     *
     * @param base64String the Base64 string to decode
     * @return the decoded bytes, or null if input is null
     */
    protected byte[] decodeBase64(String base64String) {
        if (base64String == null) {

@NullUnmarked
public class BaseEncodingBenchmark {
  private static final int INPUTS_COUNT = 0x1000;
  private static final int INPUTS_MASK = 0xFFF;

  enum EncodingOption {
    BASE64(BaseEncoding.base64()),
    BASE64_URL(BaseEncoding.base64Url()),
    BASE32(BaseEncoding.base32()),
    BASE32_HEX(BaseEncoding.base32Hex()),
    BASE16(BaseEncoding.base16());

    final BaseEncoding encoding;

import java.io.ByteArrayOutputStream;
import java.io.IOException;
import java.nio.charset.StandardCharsets;
import java.text.NumberFormat;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Base64;
import java.util.Enumeration;
import java.util.HashMap;
import java.util.HashSet;
import java.util.List;
import java.util.Locale;
import java.util.Map;
import java.util.Map.Entry;
import java.util.Set;

    private static final Base64.Encoder encoder = Base64.getEncoder();

    private static final int ID_MAX_LENGTH = 445;

    /**
     * Private constructor to prevent instantiation.
     */
    private SuggestUtil() {
    }

    /**
     * Creates a unique identifier for the given text by encoding it to a Base64 string.

    }

    /**
     * Test backward compatibility with standard Base64
     *
     * @throws Exception
     */
    public void testBackwardCompatibility() throws Exception {
        // These test cases ensure that the new java.util.Base64 implementation
        // produces the same output as the old custom implementation

        // Test case 1: Standard padding

 */
package org.codelibs.fess.opensearch.user.exentity;

import static org.codelibs.core.stream.StreamUtil.stream;

import java.util.ArrayList;
import java.util.Arrays;
import java.util.Base64;
import java.util.HashMap;
import java.util.List;
import java.util.Map;

import org.codelibs.fess.Constants;
import org.codelibs.fess.entity.FessUser;
import org.codelibs.fess.mylasta.direction.FessConfig;

pkg encoding/base32, method (*Encoding) AppendEncode([]uint8, []uint8) []uint8 #53693
pkg encoding/base64, method (*Encoding) AppendDecode([]uint8, []uint8) ([]uint8, error) #53693
pkg encoding/base64, method (*Encoding) AppendEncode([]uint8, []uint8) []uint8 #53693
pkg encoding/hex, func AppendDecode([]uint8, []uint8) ([]uint8, error) #53693

	sp, spok := claims.Lookup(policy.SessionPolicyName)
	if spok {
		// Looks like subpolicy is set and is a string, if set then its
		// base64 encoded, decode it. Decoding fails reject such
		// requests.
		spBytes, err := base64.StdEncoding.DecodeString(sp)
		if err != nil {
			// Base64 decoding fails, we should log to indicate
			// something is malforming the request sent by client.
			authNLogIf(GlobalContext, err, logger.ErrorKind)

        assertFalse(encryptedStr.contains("TestPassword456"), "Plaintext should not be visible in encrypted string");

        // Should be valid base64
        assertTrue(encryptedStr.matches("^[A-Za-z0-9+/]*={0,2}$"), "Should be valid Base64 format");

        // Decrypt from string
        char[] decrypted = storage.decryptFromString(encryptedStr);