diff --git a/lang/funcs/encoding.go b/lang/funcs/encoding.go
index f59fcf32b..856e9198d 100644
--- a/lang/funcs/encoding.go
+++ b/lang/funcs/encoding.go
@@ -6,6 +6,7 @@ import (
 	"encoding/base64"
 	"fmt"
 	"net/url"
+	"unicode/utf8"
 
 	"github.com/zclconf/go-cty/cty"
 	"github.com/zclconf/go-cty/cty/function"
@@ -26,7 +27,9 @@ var Base64DecodeFunc = function.New(&function.Spec{
 		if err != nil {
 			return cty.UnknownVal(cty.String), fmt.Errorf("failed to decode base64 data '%s'", s)
 		}
-
+		if !utf8.Valid([]byte(s)) {
+			return cty.UnknownVal(cty.String), fmt.Errorf("contents of '%s' are not valid UTF-8", s)
+		}
 		return cty.StringVal(string(sDec)), nil
 	},
 })
diff --git a/lang/funcs/encoding_test.go b/lang/funcs/encoding_test.go
index fb71de726..1bff88544 100644
--- a/lang/funcs/encoding_test.go
+++ b/lang/funcs/encoding_test.go
@@ -23,6 +23,11 @@ func TestBase64Decode(t *testing.T) {
 			cty.UnknownVal(cty.String),
 			true,
 		},
+		{ // Invalid utf-8
+			cty.StringVal("\xc3\x28"),
+			cty.UnknownVal(cty.String),
+			true,
+		},
 	}
 
 	for _, test := range tests {