diff --git a/dom/quota/EncryptedBlock.h b/dom/quota/EncryptedBlock.h
index 6c4ced7d6e2..339e614dceb 100644
--- a/dom/quota/EncryptedBlock.h
+++ b/dom/quota/EncryptedBlock.h
@@ -44,6 +44,10 @@ class EncryptedBlock {
     SetActualPayloadLength(MaxPayloadLength());
   }
 
+  static constexpr size_t RoundedUpToBasicBlockSize(const size_t aValue) {
+    return (aValue + BasicBlockSize - 1) / BasicBlockSize * BasicBlockSize;
+  }
+
   size_t MaxPayloadLength() const {
     return mData.Length() - CipherPrefixLength - CipherPrefixOffset();
   }
@@ -85,10 +89,6 @@ class EncryptedBlock {
     return RoundedUpToBasicBlockSize(sizeof(uint16_t));
   }
 
-  static constexpr size_t RoundedUpToBasicBlockSize(const size_t aValue) {
-    return (aValue + BasicBlockSize - 1) / BasicBlockSize * BasicBlockSize;
-  }
-
   nsTArray<uint8_t> mData;
 };
 
diff --git a/dom/quota/EncryptingOutputStream_impl.h b/dom/quota/EncryptingOutputStream_impl.h
index e539c83304d..775e0a6a213 100644
--- a/dom/quota/EncryptingOutputStream_impl.h
+++ b/dom/quota/EncryptingOutputStream_impl.h
@@ -207,6 +207,9 @@ nsresult EncryptingOutputStream<CipherStrategy>::FlushToBaseStream() {
     return NS_OK;
   }
 
+  const size_t roundedNextByte =
+      mEncryptedBlock->RoundedUpToBasicBlockSize(mNextByte);
+
   if (mNextByte < mEncryptedBlock->MaxPayloadLength()) {
     if (!mRandomGenerator) {
       mRandomGenerator =
@@ -218,13 +221,16 @@ nsresult EncryptingOutputStream<CipherStrategy>::FlushToBaseStream() {
 
     const auto payload = mEncryptedBlock->MutablePayload();
 
-    const auto unusedPayload = payload.From(mNextByte);
+    const auto unusedPayload = payload.From(roundedNextByte);
 
     nsresult rv = mRandomGenerator->GenerateRandomBytesInto(
         unusedPayload.Elements(), unusedPayload.Length());
     if (NS_WARN_IF(NS_FAILED(rv))) {
       return rv;
     }
+
+    std::fill(mBuffer.begin() + mNextByte, mBuffer.begin() + roundedNextByte,
+              0);
   }
 
   // XXX The compressing stream implementation this was based on wrote a stream
@@ -241,13 +247,10 @@ nsresult EncryptingOutputStream<CipherStrategy>::FlushToBaseStream() {
 
   // Encrypt the data to our internal encrypted buffer.
   // XXX Do we need to know the actual encrypted size?
-  nsresult rv = mCipherStrategy.Cipher(
-      mEncryptedBlock->MutableCipherPrefix(),
-      mozilla::Span(mBuffer.Elements(),
-                    ((mNextByte + (CipherStrategy::BasicBlockSize - 1)) /
-                     CipherStrategy::BasicBlockSize) *
-                        CipherStrategy::BasicBlockSize),
-      mEncryptedBlock->MutablePayload());
+  nsresult rv =
+      mCipherStrategy.Cipher(mEncryptedBlock->MutableCipherPrefix(),
+                             mozilla::Span(mBuffer.Elements(), roundedNextByte),
+                             mEncryptedBlock->MutablePayload());
   if (NS_WARN_IF(NS_FAILED(rv))) {
     return rv;
   }