         default: true,
         tag: "AES",
         keys: [
-          %{tag: <<1>>, key: :base64.decode("..."), default: true},
-          %{tag: <<2>>, key: :base64.decode("..."), default: false}
+          %{tag: <<1>>, key: Base.decode64!("..."), default: true},
+          %{tag: <<2>>, key: Base.decode64!("..."), default: false}
         ]
 
   If you want to store your key in the environment variable, you can use

        %{tag: <<2>>, key: "new key", default: true}
      ]

  After this, your new key will automatically be used for all new encyption, 
  while the old key will be used to decrypt legacy values.

  To migrate everything proactively to the new key, see the `mix cloak.migrate`

      "Hello"
  """
  def decrypt(<<key_tag::binary-1, iv::binary-16, ciphertext::binary>> = _ciphertext) do
    key = Cloak.Util.config(__MODULE__, key_tag)
    state = :crypto.stream_init(:aes_ctr, Cloak.Util.key_value(key), iv)

    {_state, plaintext} = :crypto.stream_decrypt(state, ciphertext)
    plaintext
  end

  @doc """
  Callback implementation for `Cloak.Cipher.version/0`. Returns the tag of the
  current default key.
  """
  def version do
    default_key().tag
  end

  defp default_key do
    Cloak.Util.default_key(__MODULE__)
  end

end
