diff --git a/protocol/src/main/kotlin/org/openrs2/protocol/Rs2Decoder.kt b/protocol/src/main/kotlin/org/openrs2/protocol/Rs2Decoder.kt
index be39a045..99594dc1 100644
--- a/protocol/src/main/kotlin/org/openrs2/protocol/Rs2Decoder.kt
+++ b/protocol/src/main/kotlin/org/openrs2/protocol/Rs2Decoder.kt
@@ -59,6 +59,10 @@ public class Rs2Decoder(public var protocol: Protocol) : ByteToMessageDecoder()
                 logger.warn { "Skipping unimplemented packet: ${decoder.javaClass}" }
             }
 
+            if (payload.isReadable) {
+                throw DecoderException("Decoder didn't read entire payload: ${decoder.javaClass}")
+            }
+
             state = State.READ_OPCODE
         }
     }
diff --git a/protocol/src/main/kotlin/org/openrs2/protocol/login/upstream/CreateAccountCodec.kt b/protocol/src/main/kotlin/org/openrs2/protocol/login/upstream/CreateAccountCodec.kt
index 53ace7c7..8a6652fe 100644
--- a/protocol/src/main/kotlin/org/openrs2/protocol/login/upstream/CreateAccountCodec.kt
+++ b/protocol/src/main/kotlin/org/openrs2/protocol/login/upstream/CreateAccountCodec.kt
@@ -59,6 +59,9 @@ public class CreateAccountCodec @Inject constructor(
 
             val email = input.readString()
 
+            // padding
+            input.skipBytes(minOf(input.readableBytes(), XTEA_BLOCK_SIZE - 1))
+
             return LoginRequest.CreateAccount(
                 build,
                 gameNewsletters,
diff --git a/protocol/src/test/kotlin/org/openrs2/protocol/Rs2DecoderTest.kt b/protocol/src/test/kotlin/org/openrs2/protocol/Rs2DecoderTest.kt
index 5af05d12..71050226 100644
--- a/protocol/src/test/kotlin/org/openrs2/protocol/Rs2DecoderTest.kt
+++ b/protocol/src/test/kotlin/org/openrs2/protocol/Rs2DecoderTest.kt
@@ -69,6 +69,16 @@ class Rs2DecoderTest {
         }
     }
 
+    @Test
+    fun testTrailingBytes() {
+        val decoder = Rs2Decoder(Protocol(LengthMismatchPacketCodec))
+        val channel = EmbeddedChannel(decoder)
+
+        assertFailsWith<DecoderException> {
+            channel.writeInbound(wrappedBuffer(0, 0x11, 0x22, 0x33, 0x44, 0x55))
+        }
+    }
+
     private fun testDecode(buf: ByteArray, expected: Packet) {
         val channel = EmbeddedChannel(
             Rs2Decoder(