diff --git a/src/ssp/database.c b/src/ssp/database.c
index 5940e29..2ceffe1 100644
--- a/src/ssp/database.c
+++ b/src/ssp/database.c
@@ -86,7 +86,9 @@ open_db(struct ssp *ctx)
 
     /* decrypt data in-place */
     char nonce[NONCE_LEN] = { 0 };
-    chacha20(ctx->sa.s + off, key, nonce, ctx->sa.s + off, ctx->sa.len - off);
+    chacha20(ctx->sa.s + salen, key, nonce, ctx->sa.s + off, ctx->sa.len - off);
+    ctx->sa.len -= off - salen;
+    off = salen;
 
     /* check internal magic, to "validate" the password */
     u32p_be((u32 *) (ctx->sa.s + off));