{"record":{"id":"95fa32775d75f6fc","repo":"gchq/CyberChef","slug":"err-95fa32","errorCode":null,"errorMessage":"${err}","messagePattern":"\\$\\{err\\}","errorType":"exception","errorClass":"OperationError","httpStatus":null,"severity":"error","filePath":"src/core/operations/FernetEncrypt.mjs","lineNumber":49,"sourceCode":"                \"value\": \"\"\n            },\n        ];\n    }\n    /**\n     * @param {String} input\n     * @param {Object[]} args\n     * @returns {String}\n     */\n    run(input, args) {\n        const [secretInput] = args;\n        try {\n            const secret = new fernet.Secret(secretInput);\n            const token = new fernet.Token({\n                secret: secret,\n            });\n            return token.encode(input);\n        } catch (err) {\n            throw new OperationError(err);\n        }\n    }\n}\n\nexport default FernetEncrypt;\n","sourceCodeStart":31,"sourceCodeEnd":55,"githubUrl":"https://github.com/gchq/CyberChef/blob/4290ea753912378913b1f3f54e0fc5720afeda5d/src/core/operations/FernetEncrypt.mjs#L31-L55","documentation":"Thrown by the Fernet Encrypt operation when the underlying fernet library raises an exception during secret creation or token.encode(). The error wraps the library's own error. Fernet encryption requires a valid 32-byte base64-encoded secret key to initialize AES-128-CBC with HMAC-SHA256.","triggerScenarios":"run(input, args) inside the try block (line 42) where new fernet.Secret(secretInput) fails (key not 32 bytes / invalid base64) or token.encode(input) fails.","commonSituations":"Key is not 32 bytes when base64-decoded, key contains invalid base64 characters, or the key string is empty/malformed. The input plaintext itself rarely causes errors.","solutions":["Provide a valid 32-byte (256-bit) secret key encoded as base64 (standard or urlsafe).","Generate a key with: python -c \"from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())\".","Verify the key decodes to exactly 32 bytes.","Check the wrapped error for the specific library message."],"exampleFix":"// before: key = 'tooshort' -> fernet.Secret throws\n\n// after: key = 'ZmDfcTF7_60GrrY167zsiPd67pEvs0aGOv2oasOM1Pg='\n//         (43-char base64url, decodes to 32 bytes)","handlingStrategy":"validation","validationCode":"// Validate Fernet key is 32 bytes base64 before encrypting\nconst keyBytes = Buffer.from(secretInput, 'base64');\nif (keyBytes.length !== 32) {\n  throw new Error('Fernet key must decode to exactly 32 bytes');\n}","typeGuard":"function isValidFernetKey(keyStr) {\n  try {\n    const decoded = Buffer.from(keyStr, 'base64');\n    return decoded.length === 32;\n  } catch { return false; }\n}","tryCatchPattern":"try {\n  const token = chef.fernetEncrypt(input, [key]);\n} catch (e) {\n  if (e.message.includes('key')) {\n    // Invalid key format\n  } else throw e;\n}","preventionTips":["Generate keys with a standard Fernet key generator.","Verify the key is 32 bytes when base64-decoded.","Store keys securely and avoid manual entry errors."],"tags":["crypto","encryption","fernet","key-validation","encrypt"],"backgroundTag":null,"analyzedSha":"4290ea753912378913b1f3f54e0fc5720afeda5d","analyzedAt":"2026-08-13T06:05:50.210Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}