diff --git a/html.c b/html.c
index 1f6d60c..3cf171e 100644
--- a/html.c
+++ b/html.c
@@ -132,7 +132,12 @@ int login(snac *snac, char *headers)
         int sz;
         xs *s1 = xs_crop(xs_dup(auth), 6, 0);
         xs *s2 = xs_base64_dec(s1, &sz);
-        xs *l1 = xs_split_n(s2, ":", 1);
+
+        /* copy to asciiz it */
+        xs *s3 = calloc(sz + 1, 1);
+        memcpy(s3, s2, sz);
+
+        xs *l1 = xs_split_n(s3, ":", 1);
 
         if (xs_list_len(l1) == 2) {
             logged_in = check_password(