{"record":{"id":"75417d8f4fd43ee2","repo":"gchq/CyberChef","slug":"invalid-bech32-string-exceeds-maximum-length-of-9","errorCode":null,"errorMessage":"Invalid Bech32 string: exceeds maximum length of 90 characters (got ${str.length}).","messagePattern":"Invalid Bech32 string: exceeds maximum length of 90 characters \\(got (.+?)\\)\\.","errorType":"exception","errorClass":"OperationError","httpStatus":null,"severity":"error","filePath":"src/core/lib/Bech32.mjs","lineNumber":244,"sourceCode":"    return result;\n}\n\n/**\n * Decode a Bech32/Bech32m string\n *\n * @param {string} str - Bech32/Bech32m encoded string\n * @param {string} encoding - \"Bech32\", \"Bech32m\", or \"Auto-detect\"\n * @returns {{hrp: string, data: number[]}} - Decoded HRP and data bytes\n */\nexport function decode(str, encoding = \"Auto-detect\") {\n    // Check for empty input\n    if (!str || str.length === 0) {\n        throw new OperationError(\"Input cannot be empty.\");\n    }\n\n    // Check maximum length\n    if (str.length > 90) {\n        throw new OperationError(`Invalid Bech32 string: exceeds maximum length of 90 characters (got ${str.length}).`);\n    }\n\n    // Check for mixed case\n    const hasUpper = /[A-Z]/.test(str);\n    const hasLower = /[a-z]/.test(str);\n    if (hasUpper && hasLower) {\n        throw new OperationError(\"Invalid Bech32 string: mixed case is not allowed. Use all uppercase or all lowercase.\");\n    }\n\n    // Convert to lowercase for processing\n    str = str.toLowerCase();\n\n    // Find separator (last occurrence of '1')\n    const sepIndex = str.lastIndexOf(\"1\");\n    if (sepIndex === -1) {\n        throw new OperationError(\"Invalid Bech32 string: no separator '1' found.\");\n    }\n","sourceCodeStart":226,"sourceCodeEnd":262,"githubUrl":"https://github.com/gchq/CyberChef/blob/4290ea753912378913b1f3f54e0fc5720afeda5d/src/core/lib/Bech32.mjs#L226-L262","documentation":"Thrown by decode() in src/core/lib/Bech32.mjs:244 when the input string is longer than 90 characters. BIP-0173 mandates a 90-character maximum for the entire Bech32 string; longer input cannot be a valid Bech32/Bech32m address and is rejected before any parsing work. This is the second early gate, right after the empty-input check.","triggerScenarios":"decode(str) where str.length === 91 or more. Common with concatenated addresses, addresses with trailing whitespace when whitespace is counted, or arbitrary text mistakenly fed in.","commonSituations":"Trailing newline/whitespace not trimmed before the length check; two addresses concatenated; pasting an address plus surrounding text from a document; an address from a chain that uses a longer format mistaken for Bech32.","solutions":["Trim the input: str = str.trim() before decoding.","Verify you are decoding a single Bech32 address, not a block of text.","If the input is legitimately long, it is not Bech32 — pick the right decoder.","Surface the actual length to the user to help them spot the extra characters."],"exampleFix":"// before - trailing whitespace pushes length over 90\ndecode(rawPasted);\n\n// after - trim first\ndecode(rawPasted.trim());","handlingStrategy":"validation","validationCode":"function normalizeBech32Input(str) {\n  if (typeof str !== 'string') throw new TypeError('Expected string');\n  const trimmed = str.trim();\n  if (trimmed.length > 90) throw new RangeError(`Input too long (${trimmed.length} > 90)`);\n  return trimmed;\n}","typeGuard":"function isWithinBech32Limit(s) {\n  return typeof s === 'string' && s.trim().length <= 90;\n}","tryCatchPattern":"try {\n  decode(raw);\n} catch (e) {\n  if (e instanceof OperationError && /exceeds maximum length of 90/.test(e.message)) {\n    raw = raw.trim(); // retry once after trimming whitespace\n  }\n}","preventionTips":["Trim pasted input before length-checking.","Reject multi-address or address-plus-text input at the UI layer.","Surface the actual length to the user when rejecting."],"tags":["bech32","decoding","bip-0173","length-limit","input-validation"],"backgroundTag":null,"analyzedSha":"4290ea753912378913b1f3f54e0fc5720afeda5d","analyzedAt":"2026-08-13T06:05:50.210Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}