{"record":{"id":"1a5f2a910ceab64e","repo":"gchq/CyberChef","slug":"err-1a5f2a","errorCode":null,"errorMessage":"${err}","messagePattern":"\\$\\{err\\}","errorType":"exception","errorClass":"OperationError","httpStatus":null,"severity":"error","filePath":"src/core/operations/JWTDecode.mjs","lineNumber":52,"sourceCode":"            },\n        ];\n    }\n\n    /**\n     * @param {string} input\n     * @param {Object[]} args\n     * @returns {JSON}\n     */\n    run(input, args) {\n        try {\n            const decoded = jwt.decode(input, {\n                json: true,\n                complete: true\n            });\n\n            return decoded.payload;\n        } catch (err) {\n            throw new OperationError(err);\n        }\n    }\n\n}\n\nexport default JWTDecode;\n","sourceCodeStart":34,"sourceCodeEnd":59,"githubUrl":"https://github.com/gchq/CyberChef/blob/4290ea753912378913b1f3f54e0fc5720afeda5d/src/core/operations/JWTDecode.mjs#L34-L59","documentation":"Thrown by JWT Decode when the underlying jsonwebtoken decode() throws. The raw Error object is passed straight into OperationError (message `${err}`), which stringifies it. Decode is unauthenticated parsing, so failures here mean the token's structure itself is unreadable.","triggerScenarios":"A string that is not a JWT: wrong number of segments (not three dot-separated parts), header or payload that is not valid base64url, or a payload that does not decode to JSON. Completely non-token input like 'hello'.","commonSituations":"Pasting a truncated token. Passing a JWE or a SAML assertion instead of a JWT. Tokens with URL-unsafe characters or whitespace/newlines that break segment splitting.","solutions":["Confirm the input is a compact JWS with exactly two dots and three base64url segments.","Trim whitespace/newlines from the token before decoding.","If it is a JWE or another format, use the matching operation, not JWT Decode.","Decode each segment manually with base64url to find which part is malformed."],"exampleFix":"// before: not a JWT\nchef.JWTDecode('abc.def');\n// after: a well-formed compact JWT\nchef.JWTDecode('header.payload.signature');","handlingStrategy":"type-guard","validationCode":"function looksLikeJwt(s) {\n  if (typeof s !== 'string') return false;\n  const parts = s.trim().split('.');\n  return parts.length === 3 && parts.every(p => /^[A-Za-z0-9_-]*$/.test(p));\n}","typeGuard":"function isCompactJwt(s) {\n  return typeof s === 'string' && s.trim().split('.').length === 3;\n}","tryCatchPattern":"try {\n  return chef.JWTDecode(input);\n} catch (e) {\n  throw new Error('Input is not a 3-segment compact JWT');\n}","preventionTips":["Confirm exactly two dots and three base64url segments.","Trim whitespace/newlines from the token first.","Do not feed JWE or SAML tokens to JWT Decode."],"tags":["jwt","crypto","input-validation","parse"],"backgroundTag":null,"analyzedSha":"4290ea753912378913b1f3f54e0fc5720afeda5d","analyzedAt":"2026-08-13T06:05:50.210Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}