{"record":{"id":"adf5bad24094584d","repo":"gchq/CyberChef","slug":"err","errorCode":null,"errorMessage":"${err}","messagePattern":"\\$\\{err\\}","errorType":"exception","errorClass":"OperationError","httpStatus":null,"severity":"error","filePath":"src/core/operations/FernetDecrypt.mjs","lineNumber":58,"sourceCode":"        ];\n    }\n    /**\n     * @param {String} input\n     * @param {Object[]} args\n     * @returns {String}\n     */\n    run(input, args) {\n        const [secretInput] = args;\n        try {\n            const secret = new fernet.Secret(secretInput);\n            const token = new fernet.Token({\n                secret: secret,\n                token: input,\n                ttl: 0\n            });\n            return token.decode();\n        } catch (err) {\n            throw new OperationError(err);\n        }\n    }\n}\n\nexport default FernetDecrypt;\n","sourceCodeStart":40,"sourceCodeEnd":64,"githubUrl":"https://github.com/gchq/CyberChef/blob/4290ea753912378913b1f3f54e0fc5720afeda5d/src/core/operations/FernetDecrypt.mjs#L40-L64","documentation":"Thrown by the Fernet Decrypt operation when the underlying fernet library raises an exception during secret creation, token construction, or token.decode(). The error is wrapped and re-thrown. Fernet is symmetric encryption using AES-128-CBC with HMAC-SHA256; decryption requires a valid 32-byte base64-encoded key and a well-formed Fernet token.","triggerScenarios":"run(input, args) inside the try block (line 49) where new fernet.Secret(secretInput) fails (invalid key), new fernet.Token({...}) fails (malformed token), or token.decode() fails (HMAC mismatch, invalid ciphertext, wrong key).","commonSituations":"Wrong decryption key, key not 32 bytes in base64, malformed/truncated Fernet token, or token encrypted with a different key. Also when the input string is not a valid Fernet token format.","solutions":["Verify the key is a valid 32-byte (256-bit) value base64url-encoded string.","Confirm the input is a well-formed Fernet token generated by the corresponding Fernet Encrypt operation.","Check the wrapped error message for specifics (e.g., 'Invalid key', 'HMAC verification failed').","Ensure the key matches the one used for encryption."],"exampleFix":"// before: key = 'shortkey', token = 'gAAAAA...' -> fernet throws\n\n// after: key = 'YWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXoxMjM0NTY=' (32-byte b64)\n//         token = valid Fernet token from same key","handlingStrategy":"validation","validationCode":"// Validate Fernet key is 32 bytes base64 before decrypting\nconst keyBytes = Buffer.from(secretInput, 'base64');\nif (keyBytes.length !== 32) {\n  throw new Error('Fernet key must decode to exactly 32 bytes');\n}","typeGuard":"function isValidFernetKey(keyStr) {\n  try {\n    const decoded = Buffer.from(keyStr, 'base64');\n    return decoded.length === 32;\n  } catch { return false; }\n}","tryCatchPattern":"try {\n  const plaintext = chef.fernetDecrypt(input, [key]);\n} catch (e) {\n  if (e.message.includes('HMAC') || e.message.includes('key')) {\n    // Wrong key or tampered token\n  } else throw e;\n}","preventionTips":["Validate the key decodes to exactly 32 bytes.","Confirm the token was encrypted with the same key.","Check the token is not truncated or URL-escaped incorrectly."],"tags":["crypto","encryption","fernet","key-validation","decrypt"],"backgroundTag":null,"analyzedSha":"4290ea753912378913b1f3f54e0fc5720afeda5d","analyzedAt":"2026-08-13T06:05:50.210Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}