Client-side only. Invalid Base64 shows a clear error instead of silent garbage.