diff --git a/api/src/action/download.rs b/api/src/action/download.rs
index ac18dd7..09e560b 100644
--- a/api/src/action/download.rs
+++ b/api/src/action/download.rs
@@ -115,7 +115,7 @@ impl<'a> Download<'a> {
 
         // Get the metadata nonce
         // TODO: don't unwrap here, return an error
-        let nonce = b64::decode_url(
+        let nonce = b64::decode_standard(
             response.headers()
                 .get_raw(HEADER_AUTH_NONCE)
                 .expect("missing authenticate header") 
diff --git a/api/src/crypto/b64.rs b/api/src/crypto/b64.rs
index 473ca8f..8a4bb16 100644
--- a/api/src/crypto/b64.rs
+++ b/api/src/crypto/b64.rs
@@ -25,5 +25,5 @@ pub fn decode_url(input: &str) -> Result<Vec<u8>, DecodeError> {
 
 /// Decode the given string as base64, with the standaard character set.
 pub fn decode_standard(input: &str) -> Result<Vec<u8>, DecodeError> {
-    decode(input, base64::STANDARD_NO_PAD)
+    decode(input, base64::STANDARD)
 }
diff --git a/api/src/reader.rs b/api/src/reader.rs
index 132f91b..6f35f23 100644
--- a/api/src/reader.rs
+++ b/api/src/reader.rs
@@ -502,7 +502,7 @@ impl Write for EncryptedFileWriter {
         }
 
         // Compute how many bytes were written
-        Ok(file_bytes - file_buf.len() + min(tag_buf.len(), tag_bytes))
+        Ok(file_buf.len() + tag_buf.len())
     }
 
     fn flush(&mut self) -> Result<(), io::Error> {