Security proofs of quantum key distribution (QKD) typically assume that the devices of the legitimate users are perfectly shielded from the eavesdropper. This assumption is, however, very hard to meet in practice, and thus the security of current QKD implementations is not guaranteed. Here, we fill this gap by providing a finite-key security analysis for QKD which is valid against arbitrary information leakage from the state preparation process of the legitimate users. For this, we extend the techniques introduced by Tamaki et al (2016 New J. Phys. 18 065008) to the finite-key regime, and we evaluate the security of a leaky decoy-state BB84 protocol with biased basis choice, which is one of the most implemented QKD schemes today. Our simulation results demonstrate the practicability of QKD over long distances and within a reasonable time frame given that the legitimate users' devices are sufficiently isolated.While the results in [1,7] constitute an important step toward guaranteeing the security of quantum communication systems in the presence of information leakage, both analyses consider the asymptotic scenario where Alice sends Bob an infinite number of light pulses. This means that these results cannot be directly applied to real-life QKD implementations, where Alice sends Bob only a finite number of signals and they distill finitelength keys [12][13][14][15][16]. In this work, we fill this gap and extend the general framework introduced in [1] to the finite-key scenario. For this, we present a finite-key parameter estimation method which can be applied in the presence of information leakage. In particular, and for concreteness, we consider a biased basis choice decoystate QKD protocol [17,18] with three-intensity settings. This is one of the most implemented QKD schemes today [19][20][21][22][23][24][25]. Note, however, that our results could be straightforwardly adapted as well to analyze the security of other decoy-state based QKD systems.In addition, we shall consider information leakage from both the IM and the PM of Alice's transmitter. The former implies that a key assumption of the decoy-state method is violated, as now the yield of an n-photon signal could depend on the intensity setting used by Alice to generate it. As a result, the security analysis cannot be based on the typical counterfactual scenario where the intensity setting for each transmitted signal is selected by Alice a posteriori, that is, after Bob has already detected all the incoming signals. To solve this problem, we use the trace distance argument introduced in [1], which relates the n-photon yields (as well as the error rates) associated to pulses generated with different intensity settings, in combination with Azuma's inequality [26]. This inequality allows us to tackle statistical fluctuations in a finite-key regime while guaranteeing security against general attacks. To include the effect of information leakage from the PM in the security analysis, we apply the quantum coin idea introduced in [27, 28] to the finite-key regime....