{"record":{"id":"9c78b2d01fd5171d","repo":"gchq/CyberChef","slug":"error-have-you-entered-the-key-correctly-the-key","errorCode":null,"errorMessage":"Error: Have you entered the key correctly? The key should be either the secret for HMAC algorithms or the PEM-encoded private key for RSA and ECDSA.\n\n${err}","messagePattern":"Error: Have you entered the key correctly\\? The key should be either the secret for HMAC algorithms or the PEM-encoded private key for RSA and ECDSA\\.\n\n(.+?)","errorType":"exception","errorClass":"OperationError","httpStatus":null,"severity":"error","filePath":"src/core/operations/JWTSign.mjs","lineNumber":62,"sourceCode":"            }\n        ];\n    }\n\n    /**\n     * @param {JSON} input\n     * @param {Object[]} args\n     * @returns {string}\n     */\n    run(input, args) {\n        const [key, algorithm, header] = args;\n\n        try {\n            return jwt.sign(input, key, {\n                algorithm: algorithm === \"None\" ? \"none\" : algorithm,\n                header: JSON.parse(header || \"{}\")\n            });\n        } catch (err) {\n            throw new OperationError(`Error: Have you entered the key correctly? The key should be either the secret for HMAC algorithms or the PEM-encoded private key for RSA and ECDSA.\n\n${err}`);\n        }\n    }\n\n}\n\nexport default JWTSign;\n","sourceCodeStart":44,"sourceCodeEnd":71,"githubUrl":"https://github.com/gchq/CyberChef/blob/4290ea753912378913b1f3f54e0fc5720afeda5d/src/core/operations/JWTSign.mjs#L44-L71","documentation":"Thrown by JWT Sign when jsonwebtoken's sign() rejects. The hint in the message points at the two dominant causes: a key that does not match the chosen algorithm, or a header argument that is not valid JSON. sign() throws for key/algorithm mismatch, malformed PEM, invalid header JSON, or unsupported algorithm.","triggerScenarios":"Selecting an HMAC algorithm (HS256) but supplying a PEM private key; selecting RSA/ECDSA but supplying a plain-text secret; header argument that is not parseable JSON (e.g. '{alg: x}'); a malformed or encrypted PEM; an algorithm string the library does not recognise.","commonSituations":"Copying a key from the wrong format. Forgetting that 'None' maps to 'none'. Passing a header with single quotes or trailing commas. Using an ECDSA key with an RSA algorithm selection.","solutions":["Match the key to the algorithm: shared secret for HMAC, PEM private key for RSA/ECDSA.","Ensure the header argument is strict JSON (double quotes, parseable by JSON.parse).","For RSA/ECDSA, supply a valid unencrypted PEM private key.","Verify the algorithm name is one jsonwebtoken supports."],"exampleFix":"// before: HMAC algorithm but a PEM key\nchef.JWTSign(payload, { key: pemPrivateKey, algorithm: 'HS256', header: '{}' });\n// after: algorithm matches the key\nchef.JWTSign(payload, { key: 'my-secret', algorithm: 'HS256', header: '{}' });","handlingStrategy":"validation","validationCode":"function validateJwtSignArgs(key, algorithm, header) {\n  if (algorithm && algorithm !== 'None')\n    JSON.parse(header || '{}'); // header must be JSON\n  const isPem = /-----BEGIN/.test(String(key));\n  if (/^HS/.test(algorithm) && isPem) throw new Error('HMAC needs a shared secret, not a PEM');\n  if (/^(RS|ES|PS)/.test(algorithm) && !isPem) throw new Error('RSA/ECDSA needs a PEM private key');\n}","typeGuard":"function keyMatchesAlgorithm(key, algorithm) {\n  const isPem = /-----BEGIN [A-Z ]*PRIVATE KEY-----/.test(String(key));\n  return /^HS|^none$/i.test(algorithm) ? !isPem : isPem;\n}","tryCatchPattern":"try {\n  return chef.JWTSign(input, { key, algorithm, header });\n} catch (e) {\n  if (/entered the key correctly/.test(e.message))\n    throw new Error('Algorithm/key mismatch or bad header JSON');\n  throw e;\n}","preventionTips":["Match HMAC algorithms with a secret, RSA/ECDSA with a PEM private key.","Keep the header strict JSON (double quotes).","Remember 'None' maps to 'none'."],"tags":["jwt","crypto","key","configuration"],"backgroundTag":null,"analyzedSha":"4290ea753912378913b1f3f54e0fc5720afeda5d","analyzedAt":"2026-08-13T06:05:50.210Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}