diff --git a/lib/src/main/java/nl/nl2312/okio/cipher/CipherSource.kt b/lib/src/main/java/nl/nl2312/okio/cipher/CipherSource.kt
index 3c629db..f2174d7 100644
--- a/lib/src/main/java/nl/nl2312/okio/cipher/CipherSource.kt
+++ b/lib/src/main/java/nl/nl2312/okio/cipher/CipherSource.kt
@@ -43,7 +43,10 @@ class CipherSource(
         }
         if (streamEnd) {
             // Finalize (with padding) if we are at the end
-            decipheredBuffer.write(cipher.doFinal())
+            val remainder = cipher.doFinal()
+            if (remainder != null) {
+                decipheredBuffer.write(remainder)
+            }
         }
 
         // Sink the requested number of bytes (or all that were still in the source)
diff --git a/lib/src/test/java/nl/nl2312/okio/cipher/CipherSourceTest.kt b/lib/src/test/java/nl/nl2312/okio/cipher/CipherSourceTest.kt
index 7119e9c..8823a18 100644
--- a/lib/src/test/java/nl/nl2312/okio/cipher/CipherSourceTest.kt
+++ b/lib/src/test/java/nl/nl2312/okio/cipher/CipherSourceTest.kt
@@ -35,6 +35,16 @@ class CipherSourceTest {
         decodeCipher.init(Cipher.DECRYPT_MODE, secretKeySpec, iv)
     }
 
+    @Test
+    fun read_emptySource() {
+        val cipheredSource = Buffer()//.write(byteArrayOf())
+
+        val decoded = CipherSource(cipheredSource, decodeCipher)
+
+        val output = Buffer().also { it.writeAll(decoded) }
+        assertThat(output.readUtf8()).isEqualTo("")
+    }
+
     @Test
     fun read_cipheredArray_oneBlock() {
         // NOTE Input is shorter than 1 cipher block of 16 bytes